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Foreword 

This Technical Specification (TS) has been produced by the 3 rd Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

x the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

Y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, updates, etc. 
Z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 

The present document defines the Universal Subscriber Identity Module (USIM) application. This application resides 
on the UICC, an IC card specified in TS 31.101 [1 1]. In particular, TS 31.101 [11] specifies the application independent 
properties of the UlCC/terminal interface such as the physical characteristics and the logical structure. 

TS 31.101 [11] is one of the core documents for this specification and is therefore referenced in many places in the 
present document. 
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1 Scope 

The present document defines the USIM application for 3G telecom network operation. 
The present document specifies: 

- specific command parameters; 

- file structures; 

- contents of Efs (Elementary Files); 

- security functions; 

- application protocol to be used on the interface between UICC (USIM) and ME. 

This is to ensure interoperability between a USIM and an ME independently of the respective manufacturer, card issuer 
or operator. 

The present document does not define any aspects related to the administrative management phase of the USIM. Any 
internal technical realisation of either the USIM or the ME is only specified where these are reflected over the interface. 
The present document does not specify any of the security algorithms which may be used. 

2 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 



[1] 


3GPP TS 21.111: 


"USIM and IC Card Requirements". 


[2] 


3 GPP TS 22.011: 


"Service accessibility". 


[3] 


3GPP TS 22.024: 


"Description of Charge Advice Information (CAI)". 


[4] 


3GPP TS 22.030: 


"Man-Machine Interface (MMI) of the User Equipment (UE)". 


[5] 


3GPP TS 23.038: 


"Alphabets and language". 


[6] 


3GPP TS 23.040: 


"Technical realization of the Short Message Service (SMS)". 


[7] 


3GPP TS 23.060: 


"General Packet Radio Service (GPRS); Service description; Stage 2". 


[8] 


3GPP TS 22.067: 


"enhanced Multi Level Precedence and Pre-emption service (eMLPP) - Stage 1" 


[9] 


3GPP TS 24.008: 
3". 


"Mobile Radio Interface Layer 3 specification; Core Network Protocols; Stage 


[10] 


3GPP TS 24.011: 
interface". 


"Point-to-Point (PP) Short Message Service (SMS) support on mobile radio 


[11] 


3GPP TS 31.101: 


"UICC-Terminal Interface, Physical and Logical Characteristics". 


[12] 


3 GPP TS 31.111: 


"USIM Application Toolkit (US AT)". 
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[13] 3GPP TS 33.102: "3GPP Security; Security Architecture". 

[14] 3GPP TS 33.103: "3GPP Security; Integration Guidelines". 

[15] 3GPP TS 22.086: "Advice of charge (AoC) Supplementary Services - Stage 1". 

[16] 3GPP TS 23.041: "Technical realization of Cell Broadcast (CB)". 

[17] 3GPP TS 02.07: "Mobile Stations (MS) features". 

[18] 3 GPP TS 51.01 1 Release 4: "Specification of the Subscriber Identity Module - Mobile Equipment 
(SIM -ME) interface". 

[19] ISO 639 (1988): "Code for the representation of names of languages". 

[20] ISO/IEC 7816-4: "Integrated circuit cards, Part 4: Organization, security and commands for 

interchange". 

[21] Void. 

[22] ITU-T Recommendation E. 164: "The international public telecommunication numbering plan". 

[23] 3GPP TS 23.073: "Support of Localised Service Area (SoLSA); Stage 2". 

[24] 3GPP TS 22.101: "Service aspects; service principles". 

[25] 3GPP TS 23.003: "Numbering, Addressing and Identification". 

[26] Void. 

[27] 3GPP TS 22.022: "Personalisation of Mobile Equipment (ME); Mobile functionality 
specification". 

[28] 3GPP TS 44.018 "Mobile Interface Layer3 Specification, Radio Resource control protocol". 

[29] 3GPP TS 23.022: "Functions related to Mobile Station (MS) in idle mode and group receive 

mode". 

[30] 3GPP TS 23.057: "Mobile Execution Environment (MexE) functional description; Stage 2". 

[31] 3GPP TS 23.122: "NAS Functions related to Mobile Station (MS) in idle mode". 

[32] Void. 

[33] 3GPP TS 25.101: "UE Radio Transmission and Reception (FDD)". 

[34] 3GPP TS 45.005: "Radio Transmission and Reception". 

[35] ISO/IEC 8825-1 (2008): "Information technology - ASN. 1 encoding rules : Specification of Basic 

Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules 
(DER)". 

[36] 3GPP TS 23.097: "Multiple Subscriber Profile (MSP)". 

[37] Void. 

[38] 3GPP TS 23.140 Release 6: "Multimedia Messaging Service (MMS); Functional description; stage 

2". 

[39] ETSI TS 102 222 V7.1.0: "Administrative commands for telecommunications applications". 

[40] 3GPP TS 24.234: "3GPP System to WLAN Interworking; UE to Network protocols;Stage 3". 

[41 ] 3GPP TS 33.234: "3G Security; Wireless Local Area Network (WLAN) interworking security". 

[42] 3GPP TS 33.220: "Generic Authentication Architecture (GAA); Generic bootstrapping 

architecture". 
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[43] 3GPP TS 33.246: "Security of Multimedia Broadcast/Multicast Service". 

[44] 3GPP TS 43.020: "Technical Specification Group Services and system Aspects; Security related 

network functions" 

[45] 3GPP2 X.S0016-000-A vl .0: "3GPP2 Multimedia Messaging System MMS Specification 

Overview, Revision A" 

[46] 3GPP TS 43.068: "Technical Specification Group Core Network; Voice Group Call Service 

(VGCS); Stage 2". 

[47] 3GPP TS 33. 1 10: "Key establishment between a Universal Integrated Circuit Card (UICC) and a 

terminal" . 

[48] IETF RFC 3629 (2003): "UTF-8, a transformation format of ISO 10646". 

[49] Open Mobile Alliance; OMA-TS-BCAST_SvcCntProtection 

URL: http://www.openmobilealliance.org/ 

[50] ETSI TS TS 102 483 V8. 1 .0: "UICC-Terminal interface; Internet Protocol connectivity between 

UICC and Terminal". 

[51] 3GPP TS 24.301: "Technical Specification Group Core Network and Terminals; Non-Access- 

Stratum (NAS) protocol for Evolved Packet Systems (EPS): Stage 3". 

[52] 3GPP TS 33.401: "3GPP System Architecture Evolution (SAE); Security architecture". 

[53] 3GPP2 C.S0074-A v 1 .0: "UICC-Terminal Interface Physical and Logical Characteristics for 

cdma2000 Spread Spectrum Systems" 

[54] 3GPP TS 22.220: "Service requirements for Home NodeBs and Home eNodeBs ". 

[55] 3GPP TS 24.341 : "Support of SMS over IP networks; Stage 3" 

[56] IETF RFC 3261: "SIP: Session Initiation Protocol". 

[57] IETF RFC 3629 (2003): "UTF-8, a transformation format of ISO 10646". 

[58] 3GPP TS 24.285: "Allowed Closed Subscriber Group (CSG) list; Management Object (MO)" 

[59] OMA Smartcard- Web-Server Approved Version 1.1-12 May 2009 

(OMA-TS-Smartcard_Web_Server-Vl_l -200905 12-A). [60] ISO/IEC 15948:2003: "Information 
technology - Computer graphics and image processing - Portable Network Graphics (PNG): 
Functional specification". 

[61] IETF RFC 2046: "Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types". 

NOTE: Available from http ://www .ietf.org/rfc/rfc2046 . txt . 

[62] ETSI TS 101 220 : "Smart Cards; ETSI numbering system for telecommunication application 

providers". 

[63] 3GPP TS 24.229: "IP multimedia call control protocol based on Session Initiation Protocol (SIP) 

and Session Description Protocol (SDP); Stage 3" 

[64] 3GPP TS 3 1 . 103: "Characteristics of the IP Multimedia Services Identity Module (ISIM) 

application". 

[65] 3GPP TS 24.368: "Non-Access Stratum (NAS) configuration Management Object (MO)". 

[66] ETSI TS 102 484 V10.1.0: "Smart Cards; Secure channel between a UICC and end-point terminal" 

[67] ISO/IEC 7816-15:2004: "Identification cards - Integrated circuit cards - Part 15: Cryptographic 

information application" 
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3 Definitions, symbols, abbreviations and coding 
conventions 

3.1 Definitions 

For the purposes of the present document, the following definition applies. 

ADM: access condition to an EF which is under the control of the authority which creates this file. 

Allocation of these levels and the respective requirements for their fulfilment are the responsibility of the 
appropriate administrative authority 

The definition of access condition ADM does not preclude the administrative authority from using ALW, PIN, 
PIN2 and NEV if required. 

A terminal does not need to evaluate access conditions indicated as ADM in the present document. 

PIN/ADM: A terminal is required to evaluate the access condition and verify it in order to access the EF if the access 
condition is set to PIN or PIN2. 

EHPLMN: represents the Equivalent HPLMNs for network selection purposes. The behaviour of EHPLMNs is defined 
in TS 23.122 [31]. 

3.2 Symbols 

For the purposes of the present document, the following symbols apply: 

II Concatenation 

8 Exclusive OR 

f 1 Message authentication function used to compute MAC 

f 1 * A message authentication code (MAC) function with the property that no valuable information can 

be inferred from the function values of fl* about those of fl, f5 and vice versa 

f2 Message authentication function used to compute RES and XRES 

f3 Key generating function used to compute CK 

f4 Key generating function used to compute IK 

f5 Key generating function used to compute AK 

3.3 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 



3GPP 


3 rd Generation Partnership Project 


AC 


Access Condition 


ACL 


APN Control List 


ADF 


Application Dedicated File 


AID 


Application Identifier 


AK 


Anonymity key 


ALW 


ALWays 


AMF 


Authentication Management Field 


AoC 


Advice of Charge 


APN 


Access Point Name 


ASME 


Access Security Management Entity 


ASN.l 


Abstract Syntax Notation One 


AuC 


Authentication Centre 


AUTN 


Authentication token 


BDN 


Barred Dialling Number 


BER-TLV 


Basic Encoding Rule - TLV 


B-TID 


Bootstrapping Transaction Identifier 


CCP 


Capability Configuration Parameter 
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CK 


Cipher key 


CLI 


Calling Line Identifier 


CNL 


Co-operative Network List 


CPBCCH 


COMPACT Packet BCCH 


CS 


Circuit switched 


DCK 


Depersonalisation Control Keys 


DF 


Dedicated File 


DO 


Data Object 


EF 


Elementary File 


EPS 


Evolved Packet System 


FCP 


File Control Parameters 


FFS 


For Further Study 


GSM 


Global System for Mobile communications 


HE 


Home Environment 


HNB 


Home NodeB 


HeNB 


Home eNodeB 


IARI 


IMS Application Reference Identifier 


ICC 


Integrated Circuit Card 


ICE 


In Case of Emergency 


ICI 


Incoming Call Information 


ICT 


Incoming Call Timer 


ID 


Identifier 


Idi 


Identity of the initiator 


Idr 


Identity of the responder 


IEI 


Information Element Identifier 


IK 


Integrity key 


IMSI 


International Mobile Subscriber Identity 


K 


USIM Individual key 


K c 


Cryptographic key used by the cipher A5 


KSI 


Key Set Identifier 


LI 


Language Indication 


LSB 


Least Significant Bit 


MAC 


Message authentication code 


MAC-A 


MAC used for authentication and key agreement 


MAC-I 


MAC used for data integrity of signalling messages 


MBMS 


Multimedia Broadcast/Multicast Service 


MCC 


Mobile Country Code 


MexE 


Mobile Execution Environment 


MF 


Master File 


MGV-F 


MTK Generation and Validation Function 


MIKEY 


Multimedia Internet KEYing 


MM 


Multimedia Message 


MMI 


Man Machine Interface 


MMS 


Multimedia Messaging Service 


MMSS 


MultiMode System Selection 


MNC 


Mobile Network Code 


MODE 


Indication packet switched/circuit switched mode 


MSB 


Most Significant Bit 


MSK 


MBMS Service Key 


MTK 


MBMS Traffic Key 


MUK 


MBMS User Key 


NEV 


NEVer 


NPI 


Numbering Plan Identifier 


OCI 


Outgoing Call Information 


OCT 


Outgoing Call Timer 


PBID 


Phonebook Identifier 


PIN 


Personal Identification Number 


PL 


Preferred Languages 


PS 


Packet switched 


PS_DO 


PIN Status Data Object 


RAND 


Random challenge 


RANDms 


Random challenge stored in the USIM 
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RES 


User response 


RFU 


Reserved for Future Use 


RST 


Reset 


SDN 


Service dialling number 


SE 


Security Environment 


SEQp 


Sequence number for MGV-F stored in the USIM 


SFI 


Short EF Identifier 


SGSN 


Serving GPRS Support Node 


SN 


Serving Network 


SQN 


Sequence number 


SRES 


Signed RESponse calculated by a USIM 


SW 


Status Word 


TLV 


Tag Length Value 


USAT 


USIM Application Toolkit 


USIM 


Universal Subscriber Identity Module 


VLR 


Visitor Location Register 


WLAN 


Wireless Local Area Network 


WSID 


WLAN Specific Identifier 


XRES 


Expected user RESponse 



3.4 Coding Conventions 

The following coding conventions apply to the present document. 

All lengths are presented in bytes, unless otherwise stated. Each byte is represented by bits b8 to bl, where b8 is the 
most significant bit (MSB) and bl is the least significant bit (LSB). In each representation, the leftmost bit is the MSB. 

The coding of Data Objects in the present document is according to TS 31.101 [11]. 

'XX': Single quotes indicate hexadecimal values. Valid elements for hexadecimal values are the numbers 

'0' to '9' and A' to 'F'. 



4 Contents of the Files 

This clause specifies the Efs for the 3GPP session defining access conditions, data items and coding. A data item is a 
part of an EF which represents a complete logical entity, e.g. the alpha tag in an EF ADN record. 

A file is associated with attributes that depending of the file type indicates how data is to be accessed e.g. file size, 
record length etc. Although in the present document some files and data items stored in a file are indicated as having a 
fixed length; when reading such structures the terminal shall derive the length of the data item from the attributes 
provided in the file information i.e. not use the fixed value specified for the file in the present document. Although the 
terminal is able to read the entire structure it should only use those elements in the data item which is recognised by the 
terminal. 

For any EF, when the SFI is not indicated in the description of the file it is not allowed to assign an SFI. If in the 
description of the file an SFI value is indicated the file shall support SFI. The SFI value shall be assigned by the card 
issuer. It is mandatory for Efs stating an SFI value ('YY') in the description of their structure to provide an SFI. For files 
where in the file description the SFI is indicated as 'Optional' the file may support an SFI. 

For an overview containing all files see figures 4.1 and 4.2. 

4.1 Contents of the Efs at the MF level 

There are four Efs at the Master File (MF) level. These Efs are specified in TS 31.101 [1 1]. 
The information in EF PL may be used by the ME for MMI purposes. 

This information may also be used for the screening of Cell Broadcast messages in a preferred language, as follows. 

When the CB Message Identifier capability is available, the ME selects only those CB messages the language of which 
corresponds to an entry in this EF or in EF LIi whichever of these Efs is used (see clause 5.1.1). The CB message 
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language is defined by the Data Coding Scheme (see TS 23.038 [5]) received with the CB message. The ME shall be 
responsible for translating the language coding indicated in the Data Coding Scheme for the Cell Broadcast Service (as 
defined in TS 23.038 [5]) to the language coding as defined in ISO 639 [19] if it is necessary to check the language 
coding in EF PL . 



4.2 Contents of files at the USIM ADF (Application DF) level 

The Efs in the USIM ADF contain service and network related information. 

The File Ids '6F1X' (for Efs), '5F1X' and '5F2X' (for DFs) with X ranging from '0' to F' are reserved under the USIM 
ADF for administrative use by the card issuer. 



4.2.1 EF L i (Language Indication) 

This EF contains the codes for one or more languages. This information, determined by the user/operator, defines the 
preferred languages of the user in order of priority. This information may be used by the ME for MMI purposes. This 
information may also be used for the screening of Cell Broadcast messages in a preferred language, as follows. 

When the CB Message Identifier capability is available, the ME selects only those CB messages the language of which 
corresponds to an entry in this EF or in EF PL _ whichever of these Efs is used (see clause 5.1.1). The CB message 
language is defined by the Data Coding Scheme (DCS: see TS 23.038 [5]) received with the CB message. The ME shall 
be responsible for translating the language coding indicated in the Data Coding Scheme for the Cell Broadcast Service 
(as defined in TS 23.038 [5]) to the language coding as defined in ISO 639 [19] if it is necessary to check the language 
coding in EF PL . 



Identifier: '6F 05' | 


Structure: transparent ' Optional 


SFl: '02' 




File size: 2n bytes, (n > 1) 


Update activity: low 


Access Conditions: 






READ 


ALW 




UPDATE 


PIN 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 


Description 


M/O 


Length 


1 to 2 


1 st language code (highest priority). 


M 


2 bytes 


3 to 4 


2 na language code 


O 


2 bytes 










2n-1 to 2n 


N tn language code (lowest priority). 


O 


2 bytes 



Coding: 



each language code is a pair of alpha-numeric characters, defined in ISO 639 [19]. Each alpha-numeric character 
shall be coded on one byte using the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set 
to 0. 



Unused language entries shall be set to FF FF'. 
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4.2.2 EF, MS i (IMSI) 

This EF contains the International Mobile Subscriber Identity (IMSI). 



Identifier: '6F07' 


' Structure: transparent 




Mandatory 


SFI: '07' 




File size: 9 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Length of IMSI 


M 


1 byte 


2 to 9 


IMSI 


M 


8 bytes 



- Length of IMSI 
Contents: 

- the length indicator refers to the number of significant bytes, not including this length byte, required for the IMSI. 
Coding: 

- according to TS 24.008 [9]. 

- IMSI 
Contents: 

- International Mobile Subscriber Identity. 
Coding: 

- this information element is of variable length. If a network operator chooses an IMSI of less than 15 digits, unused 
nibbles shall be set to 'F'. 

Byte 2: 



b8 


B7 


b6 


B5 


b4 


b3 


b2 


bl 



1 




Parity 

LSB of Digit 1 



MSB of Digit 1 



For the parity bit, see TS 24.008 [9]. 
Byte 3: 



b8 |b7 [b6 |B5 |b4 |b3 |b2 [bl 

| LSB of Digit 2 



MSB of Digit 2 
LSB of Digit 3 



MSB of Digit 3 



etc. 
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4.2.3 EF Ke ys (Ciphering and Integrity Keys) 

This EF contains the ciphering key CK, the integrity key IK and the key set identifier KSI. 



Identifier: '6F08' 


Structure: transparent 




Mandatory 


SFI 


: '08' 




File size: 33 bytes 


Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 






Bytes 


Description 


M/O 


Length 


1 


Key set identifier KSI 


M 


1 byte 


2 to 17 


Ciphering key CK 


M 


1 6 bytes 


18 to 33 


Integrity key IK 


M 


1 6 bytes 



Key Set Identifier KSI. 



Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

















KSI 

bits b4 to b8 are coded 



Ciphering key CK. 



Coding: 



the least significant bit of CK is the least significant bit of the 17 byte. The most significant bit of CK is the most 



significant bit of the 2 nd byte. 

- Integrity key IK. 
Coding: 

- the least significant bit of IK is the least significant bit of the 33 ld byte. The most significant bit of IK is the most 
significant bit of the 18 th byte. 

4.2.4 EF K ey S ps (Ciphering and Integrity Keys for Packet Switched domain) 

This EF contains the ciphering key CKPS, the integrity key IKPS and the key set identifier KSIPS for the packet 
switched (PS) domain. 



Identifier: '6F09' 


Structure: transparent 


Mandatory 


SFI: '09' 




File size: 33 bytes 


Update activity: high 


Access Conditions: 
READ 


PIN 






UPDATE 


PIN 






DEACTIVATE 


ADM 







ACTIVATE 



ADM 



Bytes 


Description 


M/O 


Length 


1 


Key set identifier KSIPS 


M 


1 byte 


2 to 17 


Ciphering key CKPS 


M 


1 6 bytes 


18 to 33 


Integrity key IKPS 


M 


1 6 bytes 



Key Set Identifier KSIPS. 



Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

















KSIPS 

bits b4 to b8 are coded 
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- Ciphering key CKPS. 
Coding: 

- the least significant bit of CKPS is the least significant bit of the 17 th byte. The most significant bit of CKPS is the 
most significant bit of the 2 nd byte. 

- Integrity key IKPS. 
Coding: 

- the least significant bit of IKPS is the least significant bit of the 33 ld byte. The most significant bit of IKPS is the 
most significant bit of the 18 th byte. 

4.2.5 EFrlmnwact (User controlled PLMN selector with Access Technology) 

If service n° 20 is "available", this file shall be present. 

This EF contains the coding for n PLMNs, where n is at least eight. This information is determined by the user and 
defines the preferred PLMNs of the user in priority order. The first record indicates the highest priority and the n* 
record indicates the lowest. The EF also contains the Access Technologies for each PLMN in this list, (see 
TS 23.122 [31]) 



Identifier: '6F60' | Structure: transparent | Optional 



SFI: 'OA' 




File size: 5n (where n >8 bytes) 


Update activity: low 



Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


1 st PLMN (highest priority) 


M 


3 bytes 


4 to 5 


1 st PLMN Access Technology Identifier 


M 


2 bytes 


6 to 8 


2 na PLMN 


M 


3 bytes 


9 to 10 


2 na PLMN Access Technology Identifier 


M 


2 bytes 










36 to 38 


8 tn PLMN 


M 


3 bytes 


39 to 40 


8 th PLMN Access Technology Identifier 


M 


2 bytes 


41 to 43 


9 ,n PLMN 


O 


3 bytes 


44 to 45 


9 tn PLMN Access Technology Identifier 


O 


2 bytes 










(5n-4) to (5n-2) 


N tn PLMN (lowest priority) 


O 


3 bytes 


(5n-1) to 5n 


N tn PLMN Access Technology Identifier 


O 


2 bytes 



- PLMN 
Contents: 

- Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

- according to TS 24.008 [9] . 

- Access Technology Identifier: 
Coding: 

2 bytes are used to select the access technology where the meaning of each bit is as follows: 

- bit = 1 : access technology selected; 

- bit = 0: access technology not selected. 

Byte5n-1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



RFU 
RFU 
RFU 
RFU 
RFU 
RFU 

E-UTRAN 
UTRAN 
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Byte 5n: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



RFU 
RFU 
RFU 
RFU 

cdma2 lxRTT 
Cdma2000 HRPD 
GSM COMPACT 
GSM 



4.2.6 EFhpplmn (Higher Priority PLMN search period) 

This EF contains the interval of time between searches for a higher priority PLMN (see TS 22.01 1 [2]). 



Identifier: '6F31' 


; Structure: transparent 




Mandatory 


SFI: '12' 




File size: 1 byte 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Time interval 


M 


1 byte 



Time interval. 
Contents: 

the time interval between two searches. 
Coding: 

the time interval is coded in integer multiples of n minutes. The range is from n minutes to a maximum value. The 
value '00' indicates that no attempts shall be made to search for any higher priority PLMN. The encoding is: 

'00': No higher priority PLMN search attempts; 
'01': n minutes; 
- '02': 2n minutes; 

'YZ': (16Y+Z)n minutes (maximum value). 
All other values shall be interpreted by the ME as a default period. 
For specification of the integer timer interval n, the maximum value and the default period refer to TS 22.01 1 [2]. 
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4.2.7 EF A cMmax (ACM maximum value) 

If service n° 13 is "available", this file shall be present. 

This EF contains the maximum value of the accumulated call meter. 



Identifier: '6F37' 



File size: 3 bytes 



Structure: transparent 



Update activity: low 



Optional 



Access Conditions: 
READ 
UPDATE 

DEACTIVATE 
ACTIVATE 



PIN 

PIN/PIN2 

(fixed during administrative management) 

ADM 

ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


Maximum value 


M 


3 bytes 



Maximum value. 
Contents: 

- maximum value of the Accumulated Call Meter (ACM). 
Coding: 

First byte: 



Second byte: 



Third byte: 



b8 


hi 


b6 


b5 


b4 


b3 


b2 


bl 


I 

2 23 


1 

2 22 


1 

2 21 


1 

2 20 


1 

2 19 


1 

2 18 


1 

2 17 


1 

2 16 


b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


I 

2 15 


1 

2 14 


1 

2 13 


1 

2 12 


1 

2 11 


1 

2 io 


1 

2 9 


1 

2 8 


b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 

2 7 


1 

2 6 


1 

2 5 


1 

2 4 


1 

2 3 


1 

2 2 


1 

2 1 


1 

2° 



For instance, '00' '00' '30' represents 2 5 +2 4 . 
All ACM data is stored in the USIM and transmitted over the USIM/ME interface as binary. 
ACMmax is not valid, as defined in TS 22.024 [3], if it is coded '000000'. 

If a GSM application is present on the UICC and the ACMmax value is to be shared between the GSM and the USIM 
application this file shall be shared between the two applications. 
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4.2.8 EFust (USIM Service Table) 

This EF indicates which services are available. If a service is not indicated as available in the USIM, the ME shall not 
select this service. 



Identifier: '6F38' [ Structure: transparent 




Mandatory 


SFI: '04' 




File size: X bytes, (X> 1) 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 


Services n°1 to n°8 


M 


1 byte 


2 


Services n°9 to n°16 


O 


1 byte 


3 


Services n ° 1 7 to n 24 


O 


1 byte 


4 


Services n°25 to n°32 





1 byte 


etc. 








X 


Services n°(8X-7) to n°(8X) 





1 byte 



-Services 
Contents: 



Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 
Service 



n°1: 
n°2: 
n°3: 
n°4: 
n°5: 
n°6: 
n°7: 
n°8: 
n<9: 
n°10 
n°11 
n°12 
n°13 
n°14 
n°15 
n°16 
n°17 
n°18 
n°19 
n°20 
n°21 
n°22 
n°23 
n°24 
n°25 
n°26 
n°27 
n°28 
n°29 
n°30 
n°31 
n°32 
n°33 
n°34 
n°35 
n°36 
n°37 
n°38 
n°39 
n°40 
n°41 



Local Phone Book 

Fixed Dialling Numbers (FDN) 

Extension 2 

Service Dialling Numbers (SDN) 
Extension3 

Barred Dialling Numbers (BDN) 
Extension4 

Outgoing Call Information (OCI and OCT) 

Incoming Call Information (ICI and ICT) 

Short Message Storage (SMS) 

Short Message Status Reports (SMSR) 

Short Message Service Parameters (SMSP) 

Advice of Charge (AoC) 

Capability Configuration Parameters 2 (CCP2) 

Cell Broadcast Message Identifier 

Cell Broadcast Message Identifier Ranges 

Group Identifier Level 1 

Group Identifier Level 2 

Service Provider Name 

User controlled PLMN selector with Access Technology 

MSISDN 

Image (IMG) 

Support of Localised Service Areas (SoLSA) 

Enhanced Multi-Level Precedence and Pre-emption Service 

Automatic Answer for eMLPP 

RFU 

GSM Access 

Data download via SMS-PP 
Data download via SMS-CB 
Call Control by USIM 
MO-SMS Control by USIM 
RUN AT COMMAND command 
shall be set to T 
Enabled Services Table 
APN Control List (ACL) 
Depersonalisation Control Keys 
Co-operative Network List 
GSM security context 
CPBCCH Information 
Investigation Scan 
MexE 
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Service n°42 
Service n°43 
Service n°44 
Service n°45 
Service n°46 
Service n°47 
Service n°48 
Service n°49 
Service n°50 
Service n°51 
Service n°52 
Service n°53 
Service n°54 
Service n°55 
Service n°56 
Service n°57 
Service n°58 
Service n°59 
Service n°60 
Service n^l 
Service n<62 
Service n<63 
Service n q 64 
Service n<65 
Service n°66 
Service n°67 
Service 11=68 
Service rT69 
Service n°70 
Service n°71 
Service n°72 
Service n°73 
Service n°74 
Service n°75 
Service n°76 
Service n°77 
Service n°78 
Service n°79 
Service n°80 
Service n'SI 
Service n°82 
Service n°83 
Service n c 84 
Service n°85 
Service r\°86 
Service n°87 
Service n°88 
Service r\°89 
Service n°90 
Service n°91 
Service n°92 
Service n°93 
Service n°94 
Service n°95 
Service n°96 



Operator controlled PLMN selector with Access Technology 

HPLMN selector with Access Technology 

Extension 5 

PLMN Network Name 

Operator PLMN List 

Mailbox Dialling Numbers 

Message Waiting Indication Status 

Call Forwarding Indication Status 

Reserved and shall be ignored 

Service Provider Display Information 

Multimedia Messaging Service (MMS) 

Extension 8 

Call control on GPRS by USIM 
MMS User Connectivity Parameters 
Network's indication of alerting in the MS (NIA) 
VGCS Group Identifier List (EFvgcs and EFvgcss) 
VBS Group Identifier List (EFvbs and EFvbss) 
Pseudonym 

User Controlled PLMN selector for l-WLAN access 
Operator Controlled PLMN selector for l-WLAN access 
User controlled WSID list 
Operator controlled WSID list 
VGCS security 
VBS security 

WLAN Reauthentication Identity 
Multimedia Messages Storage 
Generic Bootstrapping Architecture (GBA) 
MBMS security 

Data download via USSD and USSD application mode 
Equivalent HPLMN 

Additional TERMINAL PROFILE after UICC activation 

Equivalent HPLMN Presentation Indication 

Last RPLMN Selection Indication 

OMA BCAST Smart Card Profile 

GBA-based Local Key Establishment Mechanism 

Terminal Applications 

Service Provider Name Icon 

PLMN Network Name Icon 

Connectivity Parameters for USIM IP connections 

Home l-WLAN Specific Identifier List 

l-WLAN Equivalent HPLMN Presentation Indication 

l-WLAN HPLMN Priority Indication 

l-WLAN Last Registered PLMN 

EPS Mobility Management Information 

Allowed CSG Lists and corresponding indications 

Call control on EPS PDN connection by USIM 

HPLMN Direct Access 

eCall Data 

Operator CSG Lists and corresponding indications 
Support for SM-over-IP 
Support of CSG Display Control 
Communication Control for IMS by USIM 
Extended Terminal Applications 
Support of UICC access to IMS 
Non-Access Stratum configuration by USIM 



The EF shall contain at least one byte. Further bytes may be included, but if the EF includes an optional byte, then it is 
mandatory for the EF to also contain all bytes before that byte. Other services are possible in the future and will be 
coded on further bytes in the EF. The coding falls under the responsibility of the 3GPP. 

Service n°95 shall not be declared "available" if an ISIM application is present on the UICC. 

Coding: 

1 bit is used to code each service: 
bit = 1 : service available; 
bit = 0: service not available. 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



25 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Service available means that the USIM has the capability to support the service and that the service is available 
for the user of the USIM unless the service is identified as "disabled" in EF EST . 

Service not available means that the service shall not be used by the USIM user, even if the USIM has the 
capability to support the service. 

First byte: 



b8 


b7 


b6 


B5 


B4 


b3 


b2 


bl 



Service n°l 
Service n°2 
Service n°3 
Service n°4 
Service n°5 
Service n°6 
Service n°7 
Service n°8 



Second byte: 



b8 


b7 


b6 


B5 


B4 


b3 


b2 


bl 



Service n°9 
Service n°10 
Service n°ll 
Service n°12 
Service n°13 
Service n°14 
Service n°15 
Service n°16 



etc. 



4.2.9 EFacm (Accumulated Call Meter) 

If service n° 13 is "available", this file shall be present. 

This EF contains the total number of units for both the current call and the preceding calls. 

NOTE: The information may be used to provide an indication to the user for advice or as a basis for the 
calculation of the monetary cost of calls (see TS 22.086 [15]). 



SFI: Optional 




Record length: 3 bytes 


Update activity: high 



Identifier: '6F39' 



Structure: cyclic 



Optional 



Access Conditions: 
READ 
UPDATE 

INCREASE 

DEACTIVATE 

ACTIVATE 



PIN 

PIN/PIN2 

(fixed during administrative management) 

PIN 

ADM 

ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


Accumulated count of units 


M 


3 bytes 



NOTE: If a SFI is assigned, the recommended value is "1 C". However cards may exist 
that indicate another value. Therefore the terminal shall be able to handle other 
values. 



- Accumulated count of units 
Contents: 
value of the ACM. 
Coding: 

see the coding of EF A cMmax. 
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If a GSM application is present on the UICC and the ACM value is to be shared between the GSM and the USIM 
application this file shall be shared between the two applications. 

4.2.1 EFqidi (Group Identifier Level 1 ) 

If service n° 17 is "available", this file shall be present. 

This EF contains identifiers for particular USIM-ME associations. It can be used to identify a group of USIMs for a 
particular application. 



Identifier: '6F3E' 



Structure: transparent 



Optional 



File size: n bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 to n 


USIM group identifier(s) 


O 


n bytes 



4.2.1 1 EF G id2 (Group Identifier Level 2) 

If service n° 18 is "available", this file shall be present. 

This EF contains identifiers for particular USIM-ME associations. It can be used to identify a group of USIMs for a 
particular application. 



Identifier: '6F3F' 


I Structure: transparent 




Optional 


File size: n bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 to n 


USIM group identifier(s) 


O 


n bytes 



NOTE: The structure of EF GID1 and EF GID2 is identical. They are provided to allow the network operator to 
enforce different levels of security dependant on an application. 

4.2.12 EFspn (Service Provider Name) 

If service n° 19 is "available", this file shall be present. 

This EF contains the service provider name in text format and appropriate requirements for the display by the ME. The 
service provider name may also be provided in a graphical format in EF S pni- The ME shall use the service provider 
name in the text format or the graphical format or both to display the service provider name according to the rules 
defined in section 4.2.88. 
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Identifier: '6F46' ; 


Structure: transparent 




Optional 


File Size: 1 7 bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


ALWAYS 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Display Condition 


M 


1 byte 


2 to 17 


Service Provider Name 


M 


1 6 bytes 



- Display Condition 

Contents: display condition for the service provider name in respect to the registered PLMN (see TS 22.101 [24]). 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



bl=0: display of registered PLMN name not required 
when registered PLMN is either HPLMN or a PLMN in 
the service provider PLMN list (see EF S pdi) ■ 
Bl=l: display of registered PLMN name required when 
registered PLMN is either HPLMN or a PLMN in the 
service provider PLMN list (see EF SPDI ) . 
B2=0: display of the service provider name is 
required when registered PLMN is neither HPLMN nor a 
PLMN in the service provider PLMN list (see EF SPDI ) . 
B2=l: display of the service provider name is not 
required when registered PLMN is neither HPLMN nor a 
PLMN in the service provider PLMN list (see EF S p D i) • 
RFU (see TS 31.101) 



- Service Provider Name 
Contents: 

service provider string 

Coding: 

the string shall use: 

- either the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set to 0. The string 
shall be left justified. Unused bytes shall be set to 'FF'. 

- or one of the UCS2 code options defined in the annex ofTS 31.101 [11]. 

4.2.13 EFruct (Price per Unit and Currency Table) 

If service n° 13 is "available", this file shall be present. 

This EF contains the Price per Unit and Currency Table (PUCT). The PUCT is Advice of Charge related information 
which may be used by the ME in conjunction with EF ACM to compute the cost of calls in the currency chosen by the 
subscriber, as specified in TS 22.024 [3]. 



Identifier: '6F41' 


' Structure: transparent 




Optional 


File size: 5 bytes 


| Update activity: low 


Access Conditions: 
READ 
UPDATE 

DEACTIVATE 
ACTIVATE 


PIN 

PIN/PIN2 

(fixed during administrative management) 

ADM 

ADM 


Bytes 


Description 


M/O 


Length 


1 to 3 


Currency code 


M 


3 bytes 


4 to 5 


Price per unit 


M 


2 bytes 



- Currency code 
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Contents: 

the alpha-identifier of the currency code. 
Coding: 

bytes 1, 2 and 3 are the respective first, second and third character of the alpha identifier. This alpha-tagging shall 
use the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set to 0. 

- Price per unit 
Contents: 

price per unit expressed in the currency coded by bytes 1 to 3. 
Coding: 

byte 4 and bits bl to b4 of byte 5 represent the Elementary Price per Unit (EPPU) in the currency coded by bytes 1 
to 3. Bits b5 to b8 of byte 5 are the decimal logarithm of the multiplicative factor represented by the absolute value of 
its decimal logarithm (EX) and the sign of EX, which is coded for a positive sign and 1 for a negative sign. 

Byte 4: 



b8 


b7 


b6 


b5 


b4 


B3 


b2 


bl 



— I — — I — — I — — I — — I — — I — — I — — I — 

2 11 2 10 2 9 2 8 2 7 2 G 2 5 2 4 of EPPU 

Byte 5: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



2 3 2 2 2 1 2 of EPPU 

Sign of EX 

2° of Abs(EX) 

2 1 of Abs(EX) 

2 2 of Abs (EX) 



- The computation of the price per unit value is made by the ME in compliance with TS 22.024 [3] by the 
following formula: 

price per unit = EPPU * 10 EX . 

- The price has to be understood as expressed in the coded currency. 

If a GSM application is present on the UICC and the PUCT information is to be shared between the GSM and the 
USIM application, then this file shall be shared between the two applications. 

4.2.14 EFcbmi (Cell Broadcast Message identifier selection) 

If service n° 15 is "available", this file shall be present. 

This EF contains the Message Identifier Parameters which specify the type of content of the cell broadcast messages 
that the subscriber wishes the UE to accept. 

Any number of CB Message Identifier Parameters may be stored in the USIM. No order of priority is applicable. 



Identifier: '6F45' 



Structure: transparent 



Optional 



File size: 2 n bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 to 2 


CB Message Identifier 1 


O 


2 bytes 
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3 to 4 


CB Message Identifier 2 





2 bytes 










2n-1 to 2n 


CB Message Identifier n 





2 bytes 



- Cell Broadcast Message Identifier 
Coding: 

- as in TS 23.041 [16], "Message Format on BTS-MS Interface - Message Identifier"; 

- values listed show the types of message which shall be accepted by the UE; 

- unused entries shall be set to 'FF FF'. 

4.2.15 EFacc (Access Control Class) 

This EF contains the assigned access control class(es). The access control class is a parameter to control the access 
attempts. 15 classes are split into 10 classes randomly allocated to normal subscribers and 5 classes allocated to specific 
high priority users. For more information see TS 22.01 1 [2]. 



Identifier: '6F78' 


Structure: transparent 


Mandatory 


SFI: '06' 




File size: 2 bytes 


Update activity: low 


Access Conditions: 








READ 


PIN 






UPDATE 


ADM 






DEACTIVATE 


ADM 







ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 2 


Access control classes 


M 


2 bytes 



- Access control classes 
Coding: 

- each ACC is coded on one bit. An ACC is "allocated" if the corresponding bit is set to 1 and "not allocated" if this 
bit is set to 0. Bit b3 of byte 1 is set to 0. 

Byte 1: 



Byte 2: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 

15 


1 

14 


1 

13 


1 

12 


1 

11 


1 

10 


1 

09 


1 

08 


b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Number of the ACC (except for bit b3) 



07 06 05 04 03 02 01 00 Number of the ACC 



4.2.16 EFfplmn (Forbidden PLMNs) 

This EF contains the coding for n Forbidden PLMNs (FPLMN). It is read by the ME as part of the USIM initialization 
procedure and indicates PLMNs which the UE shall not automatically attempt to access. 

A PLMN is written to the EF if a network rejects a Location Update with the cause "PLMN not allowed". The ME shall 
manage the list as follows. 

When n FPLMNs are held in the EF, and rejection of a further PLMN is received by the ME from the network, the ME 
shall modify the EF using the UPDATE command. This new PLMN shall be stored in the n th position, and the existing 
list "shifted" causing the previous contents of the first position to be lost. 

When less than n FPLMNs exist in the EF, storage of an additional FPLMN shall not cause any existing FPLMN to be 
lost. 
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Dependent upon procedures used to manage storage and deletion of FPLMNs in the EF, it is possible, when less than n 
FPLMNs exist in the EF, for EFFFFF' to occur in any position. The ME shall analyse all the EF for FPLMNs in any 
position, and not regard EFFFFF' as a termination of valid data. 



Identifier: '6F7B' | Structure: transparent | Mandatory 



SFI: '0D' 




File size: 3n bytes, (n> 4) 


Update activity: low 



Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


PLMN 1 


M 


3 bytes 


4 to 6 


PLMN 2 


M 


3 bytes 


7 to 9 


PLMN 3 


M 


3 bytes 


10to 12 


PLMN 4 


M 


3 bytes 










(3n-2) to 3n 


PLMN n 


O 


3 bytes 



- PLMN 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

according to TS 24.008 [9]. 

For instance, using 246 for the MCC and 81 for the MNC and if this is stored in PLMN 3 the contents is as follows: 

Bytes 7 to 9: '42"F6"18'. 
If storage for fewer than n PLMNs is required, the unused bytes shall be set to 'FF'. 

4.2.17 EFloci (Location Information) 

This EF contains the following Location Information: 

- Temporary Mobile Subscriber Identity (TMSI); 
Location Area Information (LAI); 

- Location update status. 

See clause 5.2.5 for special requirements when updating EF LOCI . 



Identifier: '6F7E' | Structure: transparent | Mandatory 



SFI: '0B' 




File size: 1 1 bytes 


Update activity: high 



Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 4 


TMSI 


M 


4 bytes 


5 to 9 


LAI 


M 


5 bytes 


10 


RFU 


M 


1 byte 


11 


Location update status 


M 


1 byte 



- TMSI 
Contents: 

Temporary Mobile Subscriber Identity. 
Coding: 

according to TS 24.008 [9]. 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



31 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



B8 


b7 


b6 


b5 


b4 


B3 


b2 


bl 



— i — — r 

MSB 



- LAI 
Contents: 

Location Area Information. 
Coding: 

according to TS 24.008 [9]. 

Byte 5: first byte of LAI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



i — — r 

MSB 



- Location update status 
Contents: 

status of location update according to TS 24.008 [9]. 

Coding: 
Byte 11: 



b3 


b2 


bl 













: updated. 








1 


: not updated. 





1 





: PLMN not allowed. 





1 


1 


: Location Area not allowed. 


1 


1 


1 


: reserved. 



Bitsb4tob8 areRFU(see TS 31.101 [11]). 

4.2.18 EF AD (Administrative Data) 

This EF contains information concerning the mode of operation according to the type of USIM, such as normal (to be 
used by PLMN subscribers for 3G operations), type approval (to allow specific use of the ME during type approval 
procedures of e.g. the radio equipment), cell testing (to allow testing of a cell before commercial use of this cell), 
manufacturer specific (to allow the ME manufacturer to perform specific proprietary auto-test in its ME during e.g. 
maintenance phases). 

It also provides an indication about how some ME features shall work during normal operation as well as information 
about the length of the MNC, which is part of the International Mobile Subscriber Identity (IMSI). 



Identifier: '6FAD' 


Structure: transparent 


Mandatory 


SFI: '03' 




File size: 4+X bytes 


Update activity: low 



Access Conditions: 

READ ALW 

UPDATE ADM 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 


UE operation mode 


M 


1 byte 


2 to 3 


Additional information 


M 


2 bytes 


4 


length of MNC in the IMSI 


M 


1 byte 


5 to 4+X 


RFU 


O 


X bytes 



- UE operation mode: 
Contents: 

mode of operation for the UE 
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Coding: 

Initial value 

- '00' normal operation. 

- '80' type approval operations. 

- '01' normal operation + specific facilities. 

- '81' type approval operations + specific facilities. 
'02' maintenance (off line). 

- '04' cell test operation. 
All other values are RFU 



- Additional information: 
Contents: 

additional information depending on the UE operation mode 
Coding: 

- specific facilities (if bl=l in byte 1): 



Byte 2 (first byte of additional information): 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



RFU (see TS 31.101) 



Byte 3 (second byte of additional information): 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



bl=0: ciphering indicator feature disabled 
bl=l: ciphering indicator feature enabled 
b2 : CSG Display Control bit, see below 
"RFU (see TS 31.101) 



bl is used to control the ciphering indicator feature as specified in TS 22.101 [24]. 

B2 is used to indicate which CSGs the UE shall display during manual CSG selection. This bit 
corresponds to the value of OperatorCSGEntries_Only leaf described in TS 24.285 [58]. 

- b2=0: for every PLMN not included in EF_OCSGL, or for which a CSG display indicator tag is not 
present, all available CSGs can be displayed without any restriction. 

- b2=l: for every PLMN not included in EF_OCSGL or any PLMN for which a CSG display indicator 
tag is not present, only the available CSGs found in the Operator CSG list shall be displayed. 



- ME manufacturer specific information (if b2=l in byte 1): 
Byte 2 (first byte of additional information): 



B8 


b7 


b6 


B5 


B4 


b3 


b2 


bl 



Any value 



Byte 3 (second byte of additional information): 



B8 


b7 


b6 


b5 


B4 


b3 


b2 


bl 



Any value 



- Length of MNC in the IMSI: 
Contents: 

The length indicator refers to the number of digits, used for extracting the MNC from the IMSI 



Coding: 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 

Byte 4: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 
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This value codes the number of digits of the MNC in 
the IMSI. Only the values '0010' and '0011' are 
currently specified, all other values are reserved 
for future use . 
"RFU (see TS 31.101) 



4.2.19 Void 

4.2.20 EFcbmid (Cell Broadcast Message Identifier for Data Download) 

If service n° 29 is "available", this file shall be present. 

This EF contains the message identifier parameters which specify the type of content of the cell broadcast messages 
which are to be passed to the USIM. 

Any number of CB message identifier parameters may be stored in the USIM. No order of priority is applicable. 



Identifier: '6F48' | 


Structure: transparent [ Optional 


SFI: '0E' 




File size: 2n bytes 


Update activity: low 


Access Conditions: 






READ 


PIN 




UPDATE 


ADM 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 


Description 


M/O 


Length 


1 to 2 


CB Message Identifier 1 


O 


2 bytes 


3 to 4 


CB Message Identifier 2 


O 


2 bytes 










2n-1 to 2n 


CB Message Identifier n 





2 bytes 



- Cell Broadcast Message Identifier. 
Coding: 

- as in TS 23.041 [16]. Values listed show the identifiers of messages which shall be accepted by the UE to be passed 
to the USIM. 

Unused entries shall be set to EF FF'. 

4.2.21 EFecc (Emergency Call Codes) 

This EF contains emergency call codes. 



Identifier: '6FB7' | 


Structure: linear fixed Mandatory 


SFI: '01' 




Record size: X+4 bytes 


Update activity: low 


Access Conditions: 






READ 


ALW 




UPDATE 


ADM 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 


Description 


M/O 


Length 


1 to 3 


Emergency Call Code 


M 


3 bytes 


4 to X+3 


Emergency Call Code Alpha Identifier 


O 


X bytes 


X+4 


Emergency Service Category 


M 


1 byte 
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- Emergency Call Code. 
Contents: 

- Emergency Call Code. 
Coding: 

the emergency call code is of a variable length with a maximum length of 6 digits. Each emergency call code is 
coded on three bytes, with each digit within the code being coded on four bits as shown below. If a code of less than 6 
digits is chosen, then the unused nibbles shall be set to 'F'. 

Byte 1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 1 



MSB of Digit 1 
LSB of Digit 2 



MSB of Digit 2 



Byte 2: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 3 



MSB of Digit 3 
LSB of Digit 4 



MSB of Digit 4 



Byte 3: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 5 



MSB of Digit 5 
LSB of Digit 6 



MSB of Digit 6 



- Emergency Call Code Alpha Identifier. 
Contents: 

Information about the dialled emergency number to be displayed to the user. 
Coding: 

this alpha-tagging shall use 
either: 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set to 0. The alpha identifier shall 
be left justified. Unused bytes shall be set to 'FF'. 

Or 

- one of the UCS2 coded options as defined in the annex of TS 31.101 [11]. 

Emergency Service Category. 
Contents: 

Information to be sent to the network indicating the category of the emergency call. 
Coding: 

Coding according to TS 24.008 [9]. 
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4.2.22 EFcbmir (Cell Broadcast Message Identifier Range selection) 

If service n° 16 is "available", this file shall be present. 

This EF contains ranges of cell broadcast message identifiers that the subscriber wishes the UE to accept. 

Any number of CB Message Identifier Parameter ranges may be stored in the USIM. No order of priority is applicable. 



Identifier: '6F50' 


Structure: transparent 


Optional 


File size: 4n bytes 


| Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 






Bytes 


Description 


M/O 


Length 


1 to 4 


CB Message Identifier Range 1 


O 


4 bytes 


5 to 8 


CB Message Identifier Range 2 


O 


4 bytes 










(4n-3) to 4n 


CB Message Identifier Range n 





4 bytes 



- Cell Broadcast Message Identifier Ranges. 
Contents: 

- CB Message Identifier ranges: 
Coding: 

- bytes one and two of each range identifier equal the lower value of a cell broadcast range, bytes three and four equal 
the upper value of a cell broadcast range, both values are coded as in TS 23.041 [16] "Message Format on BTS-MS 
Interface - Message Identifier". Values listed show the ranges of messages which shall be accepted by the UE. 
Unused entries shall be set to FF FF FF FF'. 

4.2.23 EFrsloci (Packet Switched location information) 

This EF contains the following Location Information: 

- Packet Temporary Mobile Subscriber Identity (P-TMSI); 

Packet Temporary Mobile Subscriber Identity signature value (P-TMSI signature value); 
Routing Area Information (RAI); 

- Routing Area update status. 



Identifier: '6F73' | Structure: transparent | Mandatory 



SFI: '0C 




File size: 14 bytes 


Update activity: high 



Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 4 


P-TMSI 


M 


4 bytes 


5 to 7 


P-TMSI signature value 


M 


3 bytes 


8to13 


RAI 


M 


6 bytes 


14 


Routing Area update status 


M 


1 byte 



- P-TMSI. 

Contents: 

Packet Temporary Mobile Subscriber Identity. 
Coding: 

according to TS 24.008 [9]. 
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Byte 1: first byte of P-TMSI 



b8 


b7 


B6 


B5 


B4 


B3 


b2 


bl 



— i — — r 

MSB 



- P-TMSI signature value. 
Contents: 

Packet Temporary Mobile Subscriber Identity signature value. 
Coding: 

according to TS 24.008 [9]. 

Byte 5: first byte of P-TMSI signature value. 



B8 


b7 


B6 


B5 


B4 


B3 


b2 


bl 



— i — — r 

MSB 



- RAI 
Contents: 

Routing Area Information. 
Coding: 

according to TS 24.008 [9]. 
Byte 8: first byte of RAI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



— I — — I — — I — — I — — I — — I — — I 

MSB 

- Routing Area update status. 
Contents: 

status of routing area update according to TS 24.008 [9]. 

Coding: 
byte 14: 



b3 


b2 


bl. 













: updated. 








1 


: not updated. 





1 





: PLMN not allowed. 





1 


1 


: Routing Area not allowed. 


1 


1 


1 


: reserved. 



Bitsb4tob8 areRFU(see TS 31.101 [11]). 

4.2.24 EFfdn (Fixed Dialling Numbers) 

If service n° 2 and/or service n° 89 is "available", this file shall be present. 
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This EF contains Fixed Dialling Numbers (FDN) and/or Supplementary Service Control strings (SSC). In addition it 
contains identifiers of associated network/bearer capabilities and identifiers of extension records at the USIM ADF 
level. It may also contain an associated alpha-tagging. If this file is present in the USIM, the Enabled Services 
Table (EF EST ) shall also be present. 



Identifier: '6F3B' | Structure: linear fixed | Optional 

Record length: X+ 14 bytes | Update activity: low 

Access Conditions: 

READ PIN 

UPDATE PIN2 

DEACTIVATE ADM 

ACTIVATE ADM 





Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


O 


X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3 to X+1 2 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration2 Record Identifier 


M 


1 byte 


X+1 4 


Extension2 Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of the EF ADN (clause 4.4.2.3), with the exception 
that extension records are stored in the EF EX T2- 

By default, destination addresses which are not in EF FDN shall not be allowed on any CS bearer service/teleservice or 
SMS when FDN is enabled. 

For the FDN procedures related to SMS see TS 22.101 [24] and TS 31.111 [12]. 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 
EFadn. 

4.2.25 EFsms (Short messages) 

If service n° 10 is "available", this file shall be present. 

This EF contains information in accordance with TS 23.040 [6] comprising short messages (and associated parameters) 
which have either been received by the UE from the network, or are to be used as an UE originated message. 



Identifier: '6F3C | 


Structure: 


linear fixed 




Optional 


Record length: 176 bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Status 


M 


1 byte 


2 to 176 


Remainder 


M 


175 bytes 
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- Status. 
Contents: 

Status byte of the record which can be used as a pattern in the SEARCH RECORD command. For UE originating 
messages sent to the network, the status shall be updated when the UE receives a status report, or sends a successful 
SMS Command relating to the status report. 

Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 












i 

X 


I 

X 


1 














X 


X 


1 


















1 















1 


1 












1 


1 


1 



free space 
used space 

message received by UE from network; message read 
message received by UE from network; message to be 
read 

UE originating message; message to be sent 
RFU (see TS 31 . 101 [11] ) 



b8 b7 b6 b5 b4 b3 b2 bl 



UE originating message; message sent to the network: 
Status report not requested 

Status report requested but not (yet) received; 
Status report requested, received but not stored 
in EF-SMSR; 

Status report requested, received and stored 
in EF-SMSR; 

RFU (see TS 31 . 101 [11] ) 



Remainder. 
Contents: 

This data item commences with the TS-Service-Centre-Address as specified in TS 24.011 [10]. The bytes 
immediately following the TS-Service-Centre-Address contain an appropriate short message TPDU as specified in 
TS 23.040 [6], with identical coding and ordering of parameters. 

Coding: 

according to TS 23.040 [6] and TS 24.01 1 [10]. Any TP-message reference contained in an UE originated message 
stored in the USIM, shall have a value as follows: 



message to be sent: 
Message sent to the network: 



Value of the TP-message-reference: 
'FF'. 

the value of TP -Message-Reference used in the 
message sent to the network. 



Any bytes in the record following the TPDU shall be filled with 'FF'. 

It is possible for a TS-Service-Centre-Address of maximum permitted length, e.g. containing more than 18 address 
digits, to be associated with a maximum length TPDU such that their combined length is 176 bytes. In this case the ME 
shall store in the USIM the TS-Service-Centre-Address and the TPDU in bytes 2 to 176 without modification, except 
for the last byte of the TPDU, which shall not be stored. 



4.2.26 EFmsisdn (MSISDN) 

If service n° 21 is "available", this file shall be present. 

This EF contains MSISDN(s) related to the subscriber. In addition it contains identifiers of associated network/bearer 
capabilities and identifiers of extension records at the USIM ADF level. It may also contain an associated 
alpha-tagging. 
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Identifier: 6F40 ( 


Structure: linear fixed j. Optional 


Record length: X+14 bytes 


j Update activity: low 


Access Conditions: 




READ 


PIN 


UPDATE 


PIN/ADM 




(fixed during administrative management) 


DEACTIVATE 


ADM 


ACTIVATE 


ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


O 


X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3 to X+1 2 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration2 Record Identifier 


M 


1 byte 


X+14 


Extension5 Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of EF ADN . 

If the USIM stores more than one MSISDN number and the ME displays the MSISDN number(s) within the 
initialisation procedure then the one stored in the first record shall be displayed with priority. 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 

EF ADN . 



4.2.27 EFsmsp (Short message service parameters) 

If service n° 12 is "available", this file shall be present. 

This EF contains values for Short Message Service header Parameters (SMSP), which can be used by the ME for user 
assistance in preparation of mobile originated short messages. For example, a service centre address will often be 
common to many short messages sent by the subscriber. 

The EF consists of one or more records, with each record able to hold a set of SMS parameters. The first (or only) 
record in the EF shall be used as a default set of parameters, if no other record is selected. 

To distinguish between records, an alpha-identifier may be included within each record, coded on Y bytes. 

The SMS parameters stored within a record may be present or absent independently. When a short message is to be sent 
from the UE, the parameter in the USIM record, if present, shall be used when a value is not supplied by the user. 



Identifier: '6F42' Structure: linear fixed Optional 



Record length: 28+Y bytes | Update activity: low 



Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to Y 


Alpha-Identifier 


O 


Y bytes 


Y+1 


Parameter Indicators 


M 


1 byte 


Y+2 to Y+1 3 


TP-Destination Address 


M 


1 2 bytes 


Y+1 4 to Y+25 


TS-Service Centre Address 


M 


1 2 bytes 


Y+26 


TP-Protocol Identifier 


M 


1 byte 


Y+27 


TP-Data Coding Scheme 


M 


1 byte 


Y+28 


TP-Validity Period 


M 


1 byte 



Storage is allocated for all of the possible SMS parameters, regardless of whether they are present or absent. Any bytes 
unused, due to parameters not requiring all of the bytes, or due to absent parameters, shall be set to FF'. 
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- Alpha-Identifier. 
Contents: 

Alpha Tag of the associated SMS-parameter. 

Coding: 

see clause 4.4.2.3 (EFad N ). 

NOTE: The value of Y may be zero, i.e. the alpha-identifier facility is not used. By using the command GET 
RESPONSE the ME can determine the value of Y. 

- Parameter Indicators. 
Contents: 

each of the default SMS parameters which can be stored in the remainder of the record are marked absent or present 
by individual bits within this byte. 

Coding: 

allocation of bits: 

bit number Parameter indicated. 



1 TP-Destination Address. 

2 TS-Service Centre Address. 

3 TP-Protocol Identifier. 

4 TP-Data Coding Scheme. 

5 TP-Validity Period. 

6 reserved, set to 1 . 

7 reserved, set to 1 . 

8 reserved, set to 1 . 

Bit value Meaning. 

Parameter present. 

1 Parameter absent. 



TP -Destination Address. 
Contents and Coding: 

as defined for SM-TL address fields in TS 23.040 [6]. 

- TP-Service Centre Address. 
Contents and Coding: 

as defined for RP -Destination address Centre Address in TS 24.01 1 [10]. 

TP-Protocol Identifier. 
Contents and Coding: 
as defined in TS 23.040 [6]. 

- TP -Data Coding Scheme. 
Contents and Coding: 

as defined in TS 23.038 [5]. 

- TP- Validity Period. 
Contents and Coding: 

as defined in TS 23.040 [6] for the relative time format. 

4.2.28 EFsmss (SMS status) 

If service n° 10 is "available", this file shall be present. 

This EF contains status information relating to the short message service. 
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Identifier: '6F43' | 


Structure: transparent 




Optional 


File size: 2+X bytes 


i Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 






Bytes 


Description 


M/O 


Length 


1 


Last Used TP-MR 


M 


1 byte 


2 


SMS "Memory Cap. Exceeded" Not. Flag 


M 


1 byte 


3 to 2+X 


RFU 


O 


X bytes 



- Last Used TP-MR. 
Contents: 

- the value of the TP -Message-Reference parameter in the last mobile originated short message, as defined in 
TS 23.040 [6]. 

Coding: 

- as defined in TS 23.040 [6]. 

- SMS "Memory Capacity Exceeded" Notification Flag. 
Contents: 

- this flag is required to allow a process of flow control, so that as memory capacity in the UE becomes available, the 
Network can be informed. The process for this is described in TS 23.040 [6]. 

Coding: 

bl=l means flag unset; memory capacity available; 

bl=0 means flag set; 

b2 to b8 are reserved and set to 1 . 



4.2.29 EFsdn (Service Dialling Numbers) 

If service n° 4 and or service n° 89 is "available", this file shall be present. 

This EF contains special service numbers (SDN) and/or the respective supplementary service control strings (SSC). In 
addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records at the USIM 
ADF level. It may also contain associated alpha-tagging. If the service n° 89 is available this file will contain the eCall 
test and reconfiguration numbers that are used by an UE in eCall and normal service mode. 



Identifier: '6F49' 


Structure: linear fixed [ Optional 


Record length: X+14 bytes 


Update activity: low 


Access Conditions: 






READ 


PIN 




UPDATE 


ADM 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 


Description 


M/O 


Length 


1-X 


Alpha identifier 


O 


X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 bytes 


X+2 


TON and NPI 


M 


1 byte 


X+3 to X+1 2 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration2 Record Identifier 


M 


1 byte 


X+14 


Extension3 Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of the EF ADN (clause 4.4.2.3), with the exception 
that extension records are stored in the EF EX T3 and capability/configuration parameters are stored in EF CCP2 . 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 
EFadn- 
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4.2.30 EF EX T2 (Extension2) 

If service n° 3 is "available", this file shall be present. 

This EF contains extension data of an FDN (see FDN in 4.2.24). 



Identifier: '6F4B' | 


Structure: linear fixed | Optional 


Record length: 13 bytes 


Update activity: low 


Access Conditions: 






READ 


PIN 




UPDATE 


PIN2 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 


Description 


M/O 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


1 1 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see clause 4.4.2.4 (EF EX ti)- 

4.2.31 EF EX T3 (Extension3) 

If service n° 5 is "available", this file shall be present. 

This EF contains extension data of an SDN (see SDN in 4.2.29). 



Identifier: '6F4C 



Structure: linear fixed 



Optional 



Record length: 13 bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


1 1 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see clause 4.4.2.4 (EF EX ti)- 

4.2.32 EFsmsr (Short message status reports) 

If service n° 1 1 is "available", this file shall be present. 

This EF contains information in accordance with TS 23.040 [6] comprising short message status reports which have 
been received by the UE from the network. 

Each record is used to store the status report of a short message in a record of EF SMS . The first byte of each record is the 
link between the status report and the corresponding short message in EF SMS . 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



43 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Identifier: '6F47' \ 


Structure: linear fixed 




Optional 


Record length: 30 bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


SMS record identifier 


M 


1 


2 to 30 


SMS status report 


M 


29 bytes 



- SMS record identifier. 
Contents: 

this data item identifies the corresponding SMS record in EF S ms, e-g- if this byte is coded '05' then this status report 
corresponds to the short message in record #5 of EF SMS . 

Coding: 

- '00' - empty record; 

- '01' to 'FF' - record number of the corresponding SMS in EF SM s- 

- SMS status report: 
Contents: 

- this data item contains the SMS-STATUS-REPORT TPDU as specified in TS 23.040 [6], with identical coding and 
ordering of parameters. 

Coding: 

- according to TS 23.040 [6]. Any bytes in the record following the TPDU shall be filled with FF'. 

4.2.33 EFici (Incoming Call Information) 

If service n°9 is "available", this file shall be present. 

This EF is located within the USIM application. The incoming call information can be linked to the phone book stored 
under DF TELECO m or to the local phone book within the USIM. The EF IC i contains the information related to incoming 
calls. 

The time of the call and duration of the call are stored in this EF. This EF can also contain associated alpha identifier 
that may be supplied with the incoming call. In addition it contains identifiers of associated network/bearer capabilities 
and identifiers of extension records at the USIM ADF level. The structure of this EF is cyclic, so the contents shall be 
updated only after a call is disconnected. 

If CLI is supported and the incoming phone number matches a number stored in the phone book the incoming call 
information is linked to the corresponding information in the phone book. If the incoming call matches an entry but is 
indicated as hidden in the phone book the link is established but the information is not displayed by the ME if the code 
for the secret entry has not been verified. The ME shall not ask for the secret code to be entered at this point. 

Optionally the ME may store the link to phone book entry in the file, so that it does not need to look again for a match 
in the phone book when it reuses the entry. But the ME will have to check that the incoming call number still exits in 
the linked phone book entry, as the link might be broken (entry modified). When not used by the ME or no link to the 
phone book has been found, this field shall be set to 'FFFFFF'. 

The first byte of this link is used to identify clearly the phone book location either global (i.e. under DF TELEC0M ) or local 
(i.e. USIM specific). To allow the reuse of the referring mechanism in further implementation of the phonebook under 
discussion, this byte can be used to indicate those. 

For the current version of the phone book, the phone book entry is identified as follows: 

the record number in the EF PB r which indicates the EF ADN containing the entry; 

the record number inside the indicated EF ADN . 
The structure of EF IC i is shown below. Coding scheme is according to EF ADN 
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Structure of EF| C i 



Identifier: '6F80' | Structure: Cyclic | Optional 



SFI: '14' 




Record length: X+28 bytes 


Update activity: high 



Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


O 


X bytes 


X+1 


Length of BCD number contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3 to X+1 2 


Incoming Call Number 


M 


1 bytes 


X+1 3 


Capability/Configuration2 Record Identifier 


M 


1 byte 


X+1 4 


Extension5 Record Identifier 


M 


1 byte 


X+1 5 to X+21 


Incoming call date and time (see detail 1) 


M 


7 bytes 


X+22 to X+24 


Incoming call duration (see detail 2) 


M 


3 bytes 


X+25 


Incoming call status (see detail 3) 


M 


1 byte 


X+26 to X+28 


Link to phone book entry (see detail 4) 


M 


3 bytes 



NOTE: When the contents except incoming call status are invalid, they are filled with 'FF. 
Detail 1 Coding of date and time. 
Content: 

the date and time are defined by the ME. 
Coding: 

it is according to the extended BCD coding from Bytel to Byte 7. The first 3 bytes show year, month and day 
(yy.mm.dd). The next 3 bytes show hour, minute and second (hh.mm.ss). The last Byte 7 is Time Zone. The Time Zone 
indicates the difference, expressed in quarters of an hour, between the local time and GMT. Bit 4 in Byte 7 represents 
the algebraic sign of this difference (0: positive, 1: negative). If the terminal does not support the Time Zone, Byte 7 
shall be "FF". Byte X+15: Year. 



B8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of first digit year 



MSB of first digit year 
LSB of second digit year 



MSB of second digit year 



Byte X+16: Month 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of first digit month 



MSB of first digit month 
LSB of second digit month 



MSB of second digit month 



Byte X+17: Day 
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b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of first digit day 



MSB of first digit day 
LSB of second digit day 



MSB of second digit day 



Byte X+18: Hour 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of first digit hour 



MSB of first digit hour 
LSB of second digit hour 



MSB of second digit hour 



Byte X+19: Minute 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of first digit minute 



MSB of first digit minute 
LSB of second digit minute 



MSB of second digit minute 



Byte X+20: Second 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of first digit second 



MSB of first digit second 
LSB of second digit second 



MSB of second digit second 



Byte X+21: Time Zone 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



| LSB of first digit indicates by quarters an hour 

MSB of first digit indicates by quarters an hour 

the algebraic sign (0: positive, 1: negative) 

LSB of second digit indicates by quarters an hour 

MSB of second digit indicates by quarters an hour 

Detail 2 Coding of call duration. 

Call duration is indicated by second. 
Byte X+22: 
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b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 



2 23 2 22 2 21 2 20 2 19 2 18 2 17 2 16 



Byte X+23: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 



2 15 2 14 2 13 2 12 2 11 2 10 2 9 2 8 



Byte X+24: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


I 

2 7 


I 

2 6 


I 

2 5 


I 

2 4 


I 

2 3 


I 

2 2 


I 

2 1 


I 

2 



For instance, '00' '00' '30' represents 2 5 +2 4 . 
Detail 3 Coding of Call status. 

ByteX+25: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 





















Answered= 1 1 / Not Answered= 1 1 1 

"rfu 



Detail 4 Link to phone book entry 

For the current implementation of the phone book the following coding applies: 
Phone book reference. 
Byte X+26: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Global Phone Book (DF TELEC0M ) 

1 Local Phone Book (USIM Specific) 

"rfu 



EF PBR record number: 

- Byte X+27: Hexadecimal value. 
EFadn record number: 
- Byte X+28: Hexadecimal value. 

4.2.34 EFqci (Outgoing Call Information) 

If service n°8 is "available", this file shall be present. 

This EF is located within the USIM application. The outgoing call information can be linked to the phone book stored 
under DF TELEC om or to the local phone book within the USIM. The EF ci contains the information related to outgoing 
calls. 

The time of the call and duration of the call are stored in this EF. It may also contain associated alpha identifier. In 
addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records at the USIM 
ADF level. The structure of this file is cyclic, so the contents shall be updated only after a call is disconnected. 

If the dialled phone number matches a number stored in the phone book the outgoing call information might be linked 
to the corresponding information in the phone book. The dialled number may match with a hidden entry in the phone 
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book. If the dialled number matches a hidden entry in the phone book the link is established but the information related 
to the phone book entry is not displayed by the ME, if the hidden code has not been verified. The ME shall not perform 
hidden code verification at this point. 

Optionally, the ME may store the link to phone book entry in the file, so that it does not need to look again for a match 
in the phone book when it reuses the entry. But the ME will have to check that the outgoing call number still exists in 
the linked phone book entry, as the link might be broken (entry modified). When not used by the ME or no link to the 
phone book has been found, this field shall be set to 'FFFFFF'. 

Coding scheme is according to EF IC i. 



Structure of EF 0C i 



Identifier: '6F81' 



Structure: Cyclic 



Optional 



SFI: '15' 



Record length: X+27 bytes 



Update activity: high 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


O 


X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3 to X+1 2 


Outgoing Call Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration2 Record Identifier 


M 


1 byte 


X+1 4 


Extension5 Record Identifier 


M 


1 byte 


X+1 5 to X+21 


Outgoing call date and time 


M 


7 bytes 


X+22 to X+24 


Outgoing call duration 


M 


3 bytes 


X+25 to X+27 


Link to Phone Book Entry 


M 


3 bytes 



NOTE: When the contents are invalid, they are filled with FF'. 

4.2.35 EFict (Incoming Call Timer) 

If service n°9 is "available", this file shall be present. 

This EF contains the accumulated incoming call timer duration value for the current call and previous calls. The EF is 
USIM specific and resides within the USIM application. 

This file should have only one entry. 



Structure of EF| CT 



Identifier: '6F82' 


Structure: cyclic 


Optional 


Record length: 3 bytes 


I Update activity: high 


Access Conditions: 
READ 
UPDATE 

INCREASE 

DEACTIVATE 

ACTIVATE 


PIN 

PIN/PIN2 

(fixed during administrative management) 

PIN 

ADM 

ADM 


Bytes 


Description 


M/O 


Length 


1 to 3 


Accumulated call timer value 


M 


3 bytes 



Coding: 
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Accumulated call timer value is indicated by second. 

Byte 1: 



Byte 2: 



Byte 3: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


1 

2 23 


I 

2 22 


I 

2 21 


I 

2 20 


I 

2 19 


I 

2 18 


I 

2 17 


I 

2 16 


b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


1 

2 15 


I 

2 14 


I 

2 13 


I 

2 12 


I 

2 11 


I 

2 10 


I 

2 9 


I 

2 8 


b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 



2^ 2^ 2^ 2^ 2^ 2^ 



For example, '00' '00' '30' represents 2 5 +2 4 . 

4.2.36 EFoct (Outgoing Call Timer) 

If service n°8 is "available", this file shall be present. 

This EF contains the accumulated outgoing call timer duration value for the current call and previous calls. The EF is 
USIM specific and resides within the USIM application. The contents of this EF shall be updated only after a call is 
disconnected. The coding of this EF is the same as EF ICT . 

This file should have only one entry. 



Structure of EF ct 



Identifier: '6F83' 


Structure: cyclic 




Optional 


Record length: 3 bytes 


I Update activity: high 


Access Conditions: 
READ 
UPDATE 

INCREASE 

DEACTIVATE 

ACTIVATE 


PIN 

PIN/PIN2 

(fixed during administrative management) 

PIN 

ADM 

ADM 


Bytes 


Description 


M/O 


Length 


1 to 3 


Accumulated call timer value 


M 


3 bytes 



4.2.37 EFexts (Extension5) 

If service n° 44 is "available", this file shall be present. 
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This EF contains extension data of EF ICI , EF 0CI and EF MSISDN of the USIM application. 



Identifier: '6F4E' 


Structure: linear fixed 




Optional 


Record length: 13 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


1 1 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see EF EX ti- 

4.2.38 EF C cp2 (Capability Configuration Parameters 2) 

If service n° 14 is "available", this file shall be present. 

This EF contains parameters of required network and bearer capabilities and terminal configurations associated with a 
call established using a fixed dialling number, a barred dialling number, an MSISDN, a service dialling number, an 
incoming call, an outgoing call or an MBDN. It is referred by EF FDN , EF B dn, EF MS isdn, EF S dn, EF la , EF ci, EF MB dn and 
EFcfis at USIM ADF level. 



Identifier: '6F4F' 


Structure: linear fixed : Optional 


SFI: '16' 




Record length: X bytes, X>15 


Update activity: low 



Access Conditions: 



READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Bearer capability information element 


M 


X bytes 



Bearer capability information elements. 

- Contents and Coding: 

- see TS 24.008 [9]. The Information Element Identity (IEI) shall be excluded, i.e. the first byte of the EF CCP2 record 
shall be Length of the bearer capability contents. 

- unused bytes are filled with FF'. 

4.2.39 EF e MLPP (enhanced Multi Level Precedence and Pre-emption) 

If service n° 24 is "available", this file shall be present. 

This EF contains information about priority levels and fast call set-up conditions for the enhanced Multi Level 
Precedence and Pre-emption service that can be used by the subscriber. 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



50 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Identifier: '6FB5' 


' Structure: transparent 




Optional 


File size: 2 bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Priority levels 


M 


1 byte 


2 


Fast call set-up conditions 


M 


1 byte 



- Priority levels. 
Contents: 

- the eMLPP priority levels subscribed to. 



Coding: 



Byte 1: 



each eMLPP priority level is coded on one bit. Priority levels subscribed to have their corresponding bits 
set to 1 . Priority levels not subscribed to have their corresponding bits set to 0. Bit b8 is reserved and set 
to 0. 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



priority 
priority 
priority 
priority 
priority 
priority 
priority 

"o 



level A 

level B 

level 

level 1 

level 2 

level 3 

level 4 



NOTE: Priority levels A and B can not be subscribed to (see TS 22.067 [5] for details). 

EXAMPLE 1: If priority levels 0, 1 and 2 are subscribed to, EF c mlpp shall be coded 1C. 

- Fast call set-up conditions. 
Contents: 

for each eMLPP priority level, the capability to use a fast call set-up procedure. 
Coding: 

each eMLPP priority level is coded on one bit. Priority levels for which fast call set-up is allowed have their 
corresponding bits set to 1 . Priority levels for which fast call set-up is not allowed have their corresponding bits set to 0. 
Bit b8 is reserved and set to 0. 

Byte 2: fast call set-up condition for: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



fast call set-up condition for priority level A 

fast call set-up condition for priority level B 

fast call set-up condition for priority level 

fast call set-up condition for priority level 1 

fast call set-up condition for priority level 2 

fast call set-up condition for priority level 3 

fast call set-up condition for priority level 4 

"o 



EXAMPLE 2: If fast call set-up is allowed for priority levels 0, and 1, then byte 2 of EF eMLPP is coded '0C. 



4.2.40 EF Aae M (Automatic Answer for eMLPP Service) 

If service n° 25 is "available", this file shall be present. 
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This EF contains those priority levels (of the Multi Level Precedence and Pre-emption service) for which the ME shall 
answer automatically to incoming calls. 



Identifier: '6FB6' 


Structure: transparent 




Optional 


File size: 1 byte 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Automatic answer priority levels 


M 


1 byte 



- Automatic answer priority levels. 
Contents: 

- for each eMLPP priority level, the capability for the mobile station to answer automatically to incoming calls (with 

the corresponding eMLPP priority level). 

Coding: 

each eMLPP priority level is coded on one bit. Priority levels allowing an automatic answer from the mobile station 
have their corresponding bits set to 1 . Priority levels not allowing an automatic answer from the mobile station have 
their corresponding bits set to 0. Bit b8 is reserved and set to 0. 

Byte 1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Automatic 


answer 


priority 


for 


priority 


level 


A 


Automatic 


answer 


priority 


for 


priority 


level 


B 


Automatic 


answer 


priority 


for 


priority 


level 





Automatic 


answer 


priority 


for 


priority 


level 


1 


Automatic 


answer 


priority 


for 


priority 


level 


2 


Automatic 


answer 


priority 


for 


priority 


level 


3 


Automatic 


answer 


priority 


for 


priority 


level 


4 







EXAMPLE: If automatic answer is allowed for incoming calls with priority levels A, and 1, then EF AaeM is 
coded '0D'. 

4.2.41 Void 

4.2.42 EF Hi ddenkey (Key for hidden phone book entries) 

This EF contains the hidden key that has to be verified by the ME in order to display the phone book entries that are 
marked as hidden. The hidden key can consist of 4 to 8 digits. 



Identifier: '6FC3' 


| Structure: transparent 




Optional 


File size: 4 bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 to 4 


Hidden Key 


M 


4 bytes 



- Hidden Key. 
Coding: 

- the hidden key is coded on 4 bytes using BCD coding. The minimum number of digits is 4. Unused digits are 
padded with 'F'. 
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NOTE 1: Digits are not swapped, i.e. for instance the key "1234" is coded as '12 34 FF FF. 

NOTE 2: The phone book entries marked as hidden are not scrambled by means of the hidden key. They are stored 
in plain text in the phone book. 



4.2.43 Void 



4.2.44 EFbdn (Barred Dialling Numbers) 

If service n° 6 is "available", this file shall be present. 

This EF contains Barred Dialling Numbers (BDN) and/or Supplementary Service Control strings (SSC). In addition it 
contains identifiers of associated network/bearer capabilities and identifiers of extension records. It may also contain an 
associated alpha-tagging. As the BDN service relies on the Call Control feature, BDN shall only be available if Call 
Control is available. If this file is present in the USIM, the Enabled Services Table (EF ES t) shall also be present. 



Identifier: '6F4D' 



Structure: linear fixed 



Optional 



Record length: X+15 bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN2 
ADM 
ADM 





Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


O 


X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3 to X+1 2 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration2 Record Identifier 


M 


1 byte 


X+1 4 


Extension4 Record Identifier 


M 


1 byte 


X+15 


Comparison Method Pointer 


M 


1 byte 



For contents and coding of all data items, except for the Comparison Method Pointer, see the respective data items of 
EF ADN , with the exception that extension records are stored in the EF EXT4 and capability/configuration parameters are 
stored in EF C cp2- The Comparison Method Pointer refers to a record number in EF C mi- 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 



EF 



ADN- 



4.2.45 EF E xt4 (Extension4) 

If service n° 7 is "available", this file shall be present. 
This EF contains extension data of a BDN/SSC. 



Identifier: '6F55' | 


Structure: linear fixed 




Optional 


Record length: 13 bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVE 
ACTIVATE 


PIN 
PIN2 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


11 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see clause 4.4.2.4 EF EX ti- 
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4.2.46 EFcmi (Comparison Method Information) 

If service n° 6 is "available", this file shall be present. 

This EF contains the list of Comparison Method Identifiers and alpha-tagging associated with BDN entries (see EF BDN ). 



Identifier: '6F58' | 


Structure: linear fixed 




Optional 


Record length: X+1 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 










Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


M 


X bytes 


X+1 


Comparison Method Identifier 


M 


1 byte 



- Alpha Identifier. 
Contents: 

Alpha-tagging of the associated Comparison Method Identifier. 
Coding: 

Same as the alpha identifier in EFadn. 

- Comparison Method Identifier. 
Contents: 

this byte describes the comparison method which is associated with a BDN record. Its interpretation is not specified 
but it shall be defined by the card issuers implementing the BDN feature on their USIMs. 

Coding: 

- binary; values from to 255 are allowed. 

The default coding 255 is reserved for empty field. 



4.2.47 EFest (Enabled Services Table) 

If service n° 2, 6, 34 or 35 is "available" (as indicated in the USIM Service Table), this file shall be present. 

This EF indicates which services are enabled. If a service is not indicated as enabled in this table, the ME shall not 
select the service. 



Identifier: '6F56' | Structure: transparent | Optional 



SFI: '05' 




File size: X bytes, (X> 1) 


Update activity: low 



Access Conditions: 

READ PIN 

UPDATE PIN2 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 


Services n°1 to n°8 


M 


1 byte 


2 


Services n°9 to n°16 


O 


1 byte 


etc. 








X 


Services n°(8X-7) to n°(8X) 


O 


1 byte 



-Services 

Contents: Service n°1: 
Service n°2: 
Service n°3: 



Fixed Dialling Numbers (FDN) 
Barred Dialling Numbers (BDN) 
APN Control List (ACL) 
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The EF shall contain at least one byte. Further bytes may be included, but if the EF includes an optional byte, then the 
EF shall also contain all bytes before that byte. Other services are possible in the future. The coding falls under the 
responsibility of the 3GPP. 

Coding: 

1 bit is used to code each service: 

- bit = 1 : service activated; 

- bit = 0: service deactivated. 

- Unused bits shall be set to '0'. 

A service which is listed in this table is enabled if it is indicated as available in the USIM Service Table (UST) and 
indicated as activated in the Enabled Services Tables (EST) otherwise this service is, either not available or disabled. 

First byte: 



b8 


b7 


b6 


B5 


b4 


b3 


b2 


bl 



Service n°l 
Service n°2 
Service n°3 
Service n°4 
Service n°5 
Service n°6 
Service n°7 
Service n°8 



etc. 

4.2.48 EFacl (Access Point Name Control List) 

If service n° 35 is "available", this file shall be present. 

This EF contains the list of allowed APNs (Access Point Names). If this file is present in the USIM, the Enabled 
Services Table (EF EST ) shall also be present. 



Identifier: '6F57' | 


Structure: transparent 




Optional 


File size: X bytes (X>1) 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN2 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Number of APNs 


M 


1 byte 


2toX 


APN TLVs 


M 


X-1 byte 



For contents and coding of APN-TLV values see TS 23.003 [25]. The tag value of the APN-TLV shall be 'DD'. 
"Network provided APN" is coded with a TLV object of length zero. 

4.2.49 EF D ck (Depersonalisation Control Keys) 

If service n° 36 is "available", this file shall be present. 

This EF provides storage for the de-personalization control keys associated with the OTA de-personalization cycle of 
TS 22.022 [27]. 
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Identifier: '6F2C 



File Size: 16 bytes 



Structure: transparent 



Update activity: low 



Optional 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 to 4 


8 digits of network de-personalization control key 


M 


4 bytes 


5 to 8 


8 digits of network subset de-personalization 
control key 


M 


4 bytes 


9 to 12 


8 digits of service provider de-personalization 
control key 


M 


4 bytes 


13 to 16 


8 digits of corporate de-personalization control 
key 


M 


4 bytes 



Empty control key bytes shall be coded 'FFFFFFFF'. 

4.2.50 EFcnl (Co-operative Network List) 

If service n° 37 is "available", this file shall be present. 

This EF contains the Co-operative Network List for the multiple network personalization services defined in 
TS 22.022 [27]. 



Identifier: '6F32' 


Structure: transparent 


Optional 


File size: 6n bytes, (n > 1) | 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 to 6 


Element 1 of co-operative net list 


M 


6 bytes 




6n-5 to 6n 


Element n of co-operative net list 




O 


6 bytes 



- Co-operative Network List. 
Contents: 

- PLMN network subset, service provider ID and corporate ID of co-operative networks. 
Coding: 

- For each 6 byte list element. 

Bytes 1 to 3: PLMN (MCC + MNC): according to TS 24.008 [9]. 
Byte 4: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LS bit of network subset digit 1 



MS bit of network subset digit 1 
LS bit of network subset digit 2 



MS bit of network subset digit 2 



Byte 5: 
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b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LS bit of service provider digit 1 



MS bit of service provider digit 1 
LS bit of service provider digit 2 



MS bit of service provider digit 2 



Byte 6: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LS bit of corporate digit 1 



MS bit of corporate digit 1 
LS bit of corporate digit 2 



MS bit of corporate digit 2 



- Empty fields shall be coded with 'FF'. 

- The end of the list is delimited by the first MCC field coded 'FFF'. 

4.2.51 EFstart-hfn (Initialisation values for Hyperframe number) 

This EF contains the values of START C s and START PS of the bearers that were protected by the keys in EF K eys or 
EFkeysps at release of the last CS or PS RRC connection. These values are used to control the lifetime of the keys (see 
TS 33.102 [13]). 



Identifier: '6F5B' 


| Structure: transparent 




Mandatory 


SFI: 'OF' 




File size: 6 bytes 


Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 to 3 


STARTcs 


M 


3 bytes 


4 to 6 


STARTps 


M 


3 bytes 



- STARTcs 

Contents: Initialisation value for Hyperframe number - CS domain. 
Coding: The LSB of START CS is stored in bit 1 of byte 3. Unused nibbles are set to F'. 

- STARTps 

Contents: Initialisation value for Hyperframe number - PS domain. 
Coding: As for START CS . 
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4.2.52 EFjhreshold (Maximum value of START) 

This EF contains the maximum value of START CS or START PS . This value is used to control the lifetime of the keys 
(see TS 33.102 [13]). 



Identifier: '6F5C 



Structure: transparent 



Mandatory 



SFI: '10' 



File size: 3 bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


Maximum value of STARTcs or START PS . 


M 


3 bytes 



- Maximum value of START CS or START PS . 
Coding: As for START CS 

4.2.53 EFqplmnwact (Operator controlled PLMN selector with Access 
Technology) 

If service n° 42 is "available", this file shall be present. 

This EF contains the coding for n PLMNs where n is determined by the operator. This information is determined by the 
operator and defines the preferred PLMNs in priority order. The first record indicates the highest priority and the n* 
record indicates the lowest. The EF also contains the Access Technologies for each PLMN in this list, (see 
TS 23.122 [31]) 



Identifier: '6F61' 


Structure: transparent 


Optional 


SFI: '11' 




File size: 5n bytes , (n > 8) 


Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


1 st PLMN (highest priority) 


M 


3 bytes 


4 to 5 


1 st PLMN Access Technology Identifier 


M 


2 bytes 










36 to 38 


8 tn PLMN 


M 


3 bytes 


39 to 40 


8 tfl PLMN Access Technology Identifier 


M 


2 bytes 


41 to 43 


9 tn PLMN 


O 


3 bytes 


44 to 45 


9 tn PLMN Access Technology Identifier 


O 


2 bytes 










(5n-4) to (5n-2) 


N tn PLMN (lowest priority) 


O 


3 bytes 


(5n-1) to 5n 


N m PLMN Access Technology Identifier 


O 


2 bytes 



- PLMN. 
Contents: 

- Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

- according to TS 24.008 [9]. 

- Access Technology Identifier: 
Coding: 

- See EFplmnwact for coding. 
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4.2.54 EFhplmnwact (HPLMN selector with Access Technology) 

If service n°43 is "available", this file shall be present. 

The HPLMN Selector with access technology data field shall contain the HPLMN code, or codes together with the 
respected access technology in priority order (see TS 23.122 [31]). 



Identifier: '6F62' | Structure: Transparent | Optional 



SFl: '13' 




File size: 5n (n > 1) bytes 


Update activity: low 



Access Conditions: 

READ PIN 

UPDATE ADM 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


1 st PLMN (highest priority) 


M 


3 bytes 


4 to 5 


1 st PLMN Access Technology Identifier 


M 


2 bytes 


6 to 8 


2 na PLMN 


O 


3 bytes 


9 to 10 


2 na PLMN Access Technology Identifier 


O 


2 bytes 










(5n-4) to (5n-2) 


n m PLMN (lowest priority) 


O 


3 bytes 


(5n-1) to 5n 


n m PLMN Access Technology Identifier 


O 


2 bytes 



- PLMN 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 

Coding: 

according to TS 24.008 [47]. 

Access Technology: 

Contents: The Access Technology of the HPLMN that the ME will assume when searching for the HPLMN, in priority 
order. The first Access Technology in the list has the highest priority. 

Coding: 

See EFplmnwact for coding. 



4.2.55 EF A rr (Access Rule Reference) 

This EF contains the access rules for files located under the USIM ADF in the UICC. If the security attribute tag '8B' is 
indicated in the FCP it contains a reference to a record in this file. 



Structure of EF A rr at ADF-level 



Identifier: '6F06' 


Structure: Linear fixed 


Mandatory 


SFl: '17' 




Record Length: X bytes, (X > 0) 


Update activity: low 



Access Conditions: 

READ ALW 

UPDATE ADM 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Access Rule TLV data objects 


M 


X bytes 



This EF contains one or more records containing access rule information according to the reference to expanded format 
as defined in ISO/IEC 7816-4 [20]. Each record represents an access rule. Unused bytes in the record are set to 'FF'. 
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If the card cannot access EF ARR , any attempt to access a file with access rules indicated in this EF ARR shall not be 
granted. 



This EF contains information concerning the cell frequencies 

Network Parameter storage may reduce the extent of the terminal search of FDD, TDD or GSM carriers when selecting 
a cell. The network parameters stored in the USIM shall be in accordance with the procedures specified in this clause. 

The RE carrier frequency information is stored on 2 bytes and coded on 16 bits starting from 0,0 MHz. Each increment 
of the 16 bit value is an increment of 200 kHz in frequency. This allows the exact channel frequency to be stored in this 
data field making it independent of any band information. It is up to the terminal to associate the indicated frequency 
with a particular band, e.g. GSM 900, GSM 1800 etc. This means that a range from to 13,1 GHz can be covered, with 
the resolution of 200 kHz. The frequency indicated is always the terminal receiver carrier frequency. 

The EF provides a minimum storage capacity of 46 bytes in order to provide the capability of storing at least two cell 
information TLV objects, e.g. GSM/FDD or FDD/TDD in its minimum configuration, i.e. the terminal can rely on the 
required memory space for storing at least two cell information lists offering 8 GSM neighbour carrier frequencies and 
8 Intra/Inter frequencies, respectively. In what configuration the available memory actually is being used is up to the 
terminal. 

A terminal shall ignore a TLV object or the value of a carrier frequency which is beyond its capabilities, i.e. an FDD 
only terminal shall ignore the GSM related frequency information. When updating this file, the terminal shall update it 
with the current values available in the terminal. Updating of this file shall start from the beginning of the file. The 
terminal need not respect the structure of any information previously stored, i.e. an FDD only terminal may overwrite 
the GSM parameters stored in this file by another terminal. 

The GSM cell information constructed TLV object contains the information of the BCCH channel frequency that the 
terminal is currently camped on, indicated by tag '80'. The constructed TLV object also contains an indication of up to 
32 neighbour BCCH carrier frequencies indicated by tag '81'. In order to store a complete set of GSM network 
parameters, a total of 72 bytes is required. The terminal shall convert the BCCH channel information, as specified in 
TS 44.018 [28], received from the network into the corresponding frequency before storing it in the USIM. 

The FDD cell information constructed TLV object contains the scrambling code information for the intra frequency 
carrier, tag '80', and the inter frequency scrambling codes, tag '81'. The intra frequency carrier information may contain 
up to 32 scrambling codes (m) while there is a limitation of the number of inter frequency scrambling codes (nl, n2, 
n3). The number of inter frequencies that can be indicated is limited to three and the total amount of scrambling codes 
for the inter frequencies is limited to 32 (nl+n2+n3 <= 32), i.e. if only one inter frequency carrier is indicated, it can 
contain up to 32 scrambling codes. If two or more inter frequency carriers are indicated, a total of 32 scrambling codes 
can be provided. How the information is split between the inter frequency carriers is determined by the terminal. In 
order to store a complete set of FDD cell information a total of 146 bytes is required. The terminal shall convert the 
UARFCN information, as specified in TS 25.101 [33], received from the network into the corresponding frequency 
before storing it in the USIM. 

The TDD cell information constructed TLV object has the same structure as the FDD cell information TLV object. 
NOTE: Currently there is no inter frequency cell information required for the TDD case. 



4.2.56 



Void 



4.2.57 



EF N etpar (Network Parameters) 
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Identifier: '6FC4' 


[ Structure: transparent 




Mandatory 


File size: X bytes, 


(X > 46) | 


Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 toX 


TLV object(s) containing GSM/FDD/TDD cell 
information 


O 


X 



- EFnetpar Cell Information tags 



Description 


Value 


Information Element size 
bytes 


GSM Cell Information Tag 


'AO' 


1 


Camping Frequency Tag 


'80' 


1 


Camping Frequency Information 




2 


Neighbour Frequency Tag 


'81' 


1 


Neighbour Frequency Information 




2*m 
(8 <= m <= 32) 


FDD Cell Information Tag 


'A1' 


1 


Intra Frequency Information Tag 


'80' 


1 


Scrambling code Information 




2*m 
(8 <= m <= 32) 


Inter Frequency Information Tag 


'81' 


1 


Scrambling code information 




2*(n1+n2+n3) 
(8 <= n1+n2+n3 <= 32) 


TDD Frequency information Tag 


'A2' 


1 


Intra Frequency Information Tag 


'80' 


1 


Cell parameters ID 




2*m 
(8 <= m <= 32) 


Inter Frequency Information Tag 


'81' 


1 


Cell parameters ID 




2*(n1+n2+n3) 
(8 <= n1+n2+n3 <= 32) 



GSM Cell Information, if tag 'AO' is present in this EF the content of this TLV is as follows: 



Description 


Value 


M/O 


Length 


GSM Cell Information Tag 


'AO" 


M 




Length 


'4+ (2+2*m) 
(<=70) ' 


M 




Current camped cell BCCH frequency 
information tag 


'80' 


M 




Length 


'02' 


M 




Current camped BCCH frequency 




M 




Neighbour Cell BCCH Frequency 
information tag 


'81' 


O 




Length 


2*m (=< 32) 


O 




Neighbour BCCH carrier frequencies 




O 


2*m 
(8 <= m <= 32) 
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- FDD Cell Information. If tag 'Al' is present in this EF the content of this TLV is as follows: 



Description 


Value 


M/O 


Length 


FDD Cell Information Tag 


'A1' 


M 


1 


Length 


4+(2*m)+(4+2*n1 
) + (4+2*n2)+(4+2* 
n3) (<=144) 


M 


1 


FDD Intra Frequency information tag 


'80' 


M 


1 


Length 


2+2*m 


M 


1 


Intra Frequency carrier frequency 




M 


2 


Intra Frequency scrambling codes 




M 


2*m 
(8 <= m <= 32) 


FDD Inter Frequency information tag 
(see NOTE 1) 


'81' 


O 


1 


Length 


2+2*n (NOTE 2) 


O 


1 


Inter Frequency carrier frequencies 




O 


2 


Inter Frequency scrambling codes 




O 


2*n (NOTE 2) 


NOTE 1 : This TLV object may occur up to 3 times within the constructed TLV object 

depending how many inter frequencies are indicated 
NOTE 2: n is in this case n1 , n2 or n3, 8 <= (n1 +n2+n3)<=32 



- TDD Cell Information: If tag 'A2' is present in this EF the content of this TLV is as follows: 



Description 


Value 


M/O 


Length 


TDD Cell Information Tag 


'A2' 


M 


1 


Length 


4+(2*m)+(4+2*n1 
) + (4+2*n2)+(4+2* 
n3) (<=144) 


M 


1 


TDD Intra Frequency information tag 


'80' 


M 


1 


Length 


2+2*m 


M 


1 


Intra Frequency carrier frequency 




M 


2 


Intra Frequency scrambling codes 




M 


2*m 
(8 <= m <= 32) 


TDD Inter Frequency information tag 
(see NOTE 1) 


'81' 





1 


Length 


2+2*n (NOTE 2) 





1 


Inter Frequency carrier frequencies 







2 


Inter Frequency scrambling codes 




O 


2*n (NOTE 2) 


NOTE 1 : This TLV object may occur up to 3 times within the constructed TLV object 

depending how many inter frequencies are indicated 
NOTE 2: n is in this case n1 , n2 or n3, 8 <= (n1 +n2+n3)<=32 



4.2.58 EFrnn (PLMN Network Name) 

If service n°45 is "available", this file shall be present. 

This EF contains the full and short form versions of the network name for the registered PLMN. The ME shall use these 
versions in place of its own versions of the network name for the PLMN (stored in the ME's memory list), and also in 
place of the versions of the network name received when registered to the PLMN, as defined by TS 24.008 [9]. 

This file may also contain PLMN additional information to be displayed to the user during the Manual Network 
Selection procedures as defined in TS 23.122 [31]. 

If the EFopl is not present, then the first record in this EF is used for the default network name when registered in the 
HPLMN (if the EHPLMN list is not present or is empty) or an EHPLMN (if the EHPLMN list is present). 
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Identifier: '6FC5' | Structure: linear fixed | Optional 



SFI: '19' 




Record length: X bytes; X > 3 


Update activity: low 



Access Conditions: 

READ ALWAYS 

UPDATE ADM 

ACTIVATE ADM 

DEACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Network name TLV objects 


M 


X bytes 



- Network name TLV objects. 

The content and coding (Full name for network and Short name for network) is defined below, where the fields 
within the objects are defined in TS 24.008 [9]: 



Coding of the Network name TLV objects 



Length 


Description 


Status 


1 byte 


Full name for network IEI: '43' 
(This shall be the same as that used in the 
MM/GMM INFORMATION message). 


M 


1 byte 


Length of Full name for network Name contents 


M 


Y bytes 


Full name for network contents (Octets 3 to n of 
network name information element) 


M 


1 byte 


Short name for network IEI: '45' 

(This shall be the same as that used in the 

MM/GMM INFORMATION message). 


O 


1 byte 


Length of Short name for network 


C1 


Z bytes 


Short name for network contents (Octets 3 to n 
of network name information element) 


C1 


1 byte 


PLMN Additional Information tag ('80') 


O 


1 byte 


Length of PLMN Additional Information 


C2 


W bytes 


PLMN Additional Information (coded using one 
of the UCS2 code options as defined in 
TS 31.101 [11]). 


C2 


C1 : this field shall be present if the short name for network IEI is present 
C2: this field shall be present if the PLMN Additional Information tag is 
present 



Unused bytes shall be set to 'FP. 

4.2.59 EFopl (Operator PLMN List) 

If service n°46 is "available", this file shall be present. 

This EF contains a prioritised list of Location Area Information (LAI) or Tracking Area Identity (TAI) identities that 
are used to associate a specific operator name contained in EF PNN or EF PNNI with the LAI/TAI. The ME shall use this EF 
in association with the EF PNN in place of any network name stored within the ME's internal list and any network name 
received when registered to the PLMN, as defined by TS 24.008 [9] or TS 24.301 [51]. The PLMN Network Name may 
also be provided in a graphical format in EF PNNI . The ME shall use the text format or the graphical format or both to 
display the service provider name according to the rules defined in section 4.2.89. 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



63 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Identifier: '6FC6' 


Structure: linear fixed 


Conditional 
(see Note) 


SFI: '1A' 




Record length: X bytes, (X > 8) 


Update activity: low 



Access Conditions: 

READ ALWAYS 

UPDATE ADM 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 7 


Location Area Identity/Tracking Area Identity 


M 


7 bytes 


8 


PLMN Network Name Record Identifier 


M 


1 byte 


NOTE: This file is mandatory if and only if EFpnn is present. 



- Location Area Identity/Tracking Area Identity 
Contents: 

Location Area Information, this comprises of the MCC, MNC and LAC 
Tracking Area Identity, this comprises of the MCC, MNC and TAC 

Coding: 

PLMN : according to TS 24.008 [9]/TS 24.301 [51] 

A BCD value of 'D' in any of the MCC and/or MNC digits shall be used to indicate a "wild" value for that 
corresponding MCC/MNC digit 

LAC/TAC : according to TS 24.008 [9]/TS 24.301 [51] 

Two values for the LAC/TAC are stored in order to allow a range of LAC/TAC values to be specified for a 
given PLMN. A value of '0000' stored in bytes 4 to 5 and a value of 'FFFE' stored in bytes 6 to 7 shall be 
used to indicate the entire range of LACs/TACs for the given PLMN. In the case where only a single 
LAC/TAC value is to be specified then the value stored in bytes 4 to 5 shall be identical to the value stored 
in bytes 6 to 7 for the given PLMN. If a range of LAC/TAC values are to be specified, then the value stored 
in bytes 4 to 5 shall be the start of the LAC/TAC range and the value stored in bytes 6 to 7 shall be the end 
of the LAC/TAC range for the given PLMN. 

- PLMN Network Name Record Identifier 



Contents: 

Identifier of operator name to be displayed 
Coding: 

A value of '00' indicates that the name is to be taken from other sources, see TS 22.101 [24] 

A value in the range '01' to 'FE' indicates the record number in EF PNN that shall be displayed as the registered 
PLMN name. It also indicates the record number in EF PNNI that may be displayed as the registered PLMN 
name icon. 

NOTE: The intent of this file is to provide exceptions to the other sources of a network name. Care should be 
taken not to introduce too many PLMN entries. An excessive number of entries could result in a longer 
initialisation period. 



4.2.60 EFmbdn (Mailbox Dialling Numbers) 

If service n°47 is "available", this file shall be present. 

This EF contains dialling numbers to access mailboxes associated with Voicemail, Fax, Electronic Mail and other 
messages. It may also contain associated alpha-tags for each supported mailbox. Each dialling number shall be 
associated with a message waiting indication group type using EF MBI (see TS 23.038 [5] for message waiting indication 
group types). 
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Identitier: 6FC7 , 


Structure: linear fixed | Optional 


Record length: X+14 bytes 


i Update activity: low 


Access Conditions: 




READ 


PIN 


UPDATE 


PIN/ADM 




(fixed during administrative management) 


DEACTIVATE 


ADM 


ACTIVATE 


ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


O 


X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3 to X+1 2 


Dialling Number/SSC contents 


M 


1 bytes 


X+1 3 


Capability/Configuration2 Record Identifier 


M 


1 byte 


X+14 


Extension 6 Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of the EF ADN (clause 4.4.2.3), with the exception 
that extension records are stored in the EF EX T6 and with the exception that Capability/Configuration parameters are 
stored in the EF C cp2. 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 
EFadn- 



4.2.61 EF EX T6 (Extension6) 

This EF contains extension data of an MBDN (see MBDN in 4.2.60). 



Identifier: '6FC8' 


Structure: linear fixed j Optional 


Record length: 13 bytes 


Update activity: low 


Access Conditions: 






READ 


PIN 




UPDATE 


PIN/ADM 




(fixed during administrative management) 


DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 


Description 


M/O 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


1 1 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding, see clause 4.4.2.4 (EF EX ti). 



4.2.62 EFmbi (Mailbox Identifier) 

If service n°47 is "available", this file shall be present. 

This EF contains information to associate mailbox dialling numbers in EF MB dn with a message waiting indication group 
type and subscriber profile (as defined in TS 23.097 [36]). A message waiting indication group type may either be 
Voicemail, Fax, Electronic Mail, Other or Videomail (as defined in TS 23.040 [6]). 

This EF contains as many records as there are subscriber profiles (shall be record to subscriber profile). Each record 
contains references to mailbox dialling numbers in EF MBDN (one reference for each message waiting indication group 
type). 
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Identifier: '6FC9' 



Structure: linear fixed 



Optional 



Record length: X bytes, (X > 4) 



Update activity: low 



Access Conditions: 
READ 
UPDATE 

DEACTIVATE 
ACTIVATE 



PIN 

PIN/ADM 

(fixed during administrative management) 

ADM 

ADM 



Bytes 


Description 


M/O 


Length 


1 


Mailbox Dialling Number Identifier - Voicemail 


M 


1 byte 


2 


Mailbox Dialling Number Identifier - Fax 


M 


1 byte 


3 


Mailbox Dialling Number Identifier - Electronic 
Mail 


M 


1 byte 


4 


Mailbox Dialling Number Identifier - Other 


M 


1byte 


5 


Mailbox Dialling Number Identifier - Videomail 





1 byte 



- Mailbox Dialling Number Identifier (message waiting group type = Voicemail, Fax, Electronic Mail, Other or 
Videomail). 
Contents: 

Identifies the mailbox dialling number to be associated with message waiting type. 
Coding: 

'00' - no mailbox dialling number associated with message waiting indication group type, 
'xx' - record number in EF MBDN associated with message waiting indication group type. 

4.2.63 EFmwis (Message Waiting Indication Status) 

If service n°48 is "available", this file shall be present. 

This EF contains the status of indicators that define whether or not a Voicemail, Fax, Electronic Mail, Other or 
Videomail message is waiting (as defined in TS 23.040 [6]). The ME uses the status after re-activation to determine 
whether or not to display the respective message-waiting indication on its display. 

This EF contains as many records as there are subscriber profiles (shall be record to subscriber profile) as defined in 
TS 23.097 [36] for MSP. 



Identifier: '6FCA' 



Structure: Linear fixed 



Optional 



Record length: X bytes, (X > 5) 



Update activity: high 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


Message Waiting Indicator Status 


M 


1 byte 


2 


Number of Voicemail Messages Waiting 


M 


1 byte 


3 


Number of Fax Messages Waiting 


M 


1 byte 


4 


Number of Electronic Mail Messages Waiting 


M 


1 byte 


5 


Number of Other Messages Waiting 


M 


1 byte 


6 


Number of Videomail Messages waiting 


O 


1 byte 



Message Waiting Indication Status 
Contents: 

Indicates the status of the message-waiting indication. 



Coding: 

The indicator status for each indicator type is 1 bit long and set as follows: 
bit = 1 : Set Indication Active 
bit = 0: Set Indication Inactive 
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b8 


b7 


B6 


b5 


b4 


b3 


b2 


bl 



Message Waiting Indication Status - Voicemail 

Message Waiting Indication Status - Fax 

Message Waiting Indication Status - Electronic Mail 

Message Waiting Indication Status - Other 

Message Waiting Indication Status - Videomail 

RFU 



Number of Voicemail Messages Waiting 
Contents: 

Contains the number of voicemail messages waiting (see TS 23.040 [6]). 

Coding: 
Binary. 

Number of Fax Messages Waiting 
Contents: 

Contains the number of fax messages waiting (see TS 23.040 [6]). 
Coding: 

Binary. 

Number of Electronic Mail Messages Waiting 
Contents: 

Contains the number of electronic mail messages waiting (see TS 23.040 [6]) 
Coding: 

Binary. 

Number of Other Messages Waiting 
Contents: 

Contains the number of other messages waiting (see TS 23.040 [6]). 
Coding: 

Binary. 

Number of Videomail Messages Waiting 
Contents: 

Contains the number of Videomail messages waiting (see TS 23.040 [6]). 

Coding: 

Binary. 

4.2.64 EFcfis (Call Forwarding Indication Status) 

If service n°49 is "available", this file shall be present. 

This EF contains the status of indicators that are used to record whether call forward is active. The ME uses the status 
after re-activation to determine whether or not to display the respective Call Forwarding indicator on its display. 

This EF contains as many records as there are subscriber profiles (shall be record to subscriber profile) as defined in 
TS 23.097 [36] for MSP. 
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Identifier: '6FCB' | Structure: Linear Fixed | Optional 

Record length: 16 bytes | Update activity: low 

Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 


MSP number 


M 


1 byte 


2 


CFU indicator status 


M 


1 byte 


3 


Length of BCD number 


M 


1 byte 


4 


TON and NPI 


M 


1 byte 


5 to 14 


Dialling Number 


M 


1 bytes 


15 


Capability/Configuration2 Record Identifier 


M 


1 byte 


16 


Extension 7 Record Identifier 


M 


1 byte 



NOTE: For contents and coding of data items not detailed below, see the respective data items of EF ADN (clause 
4.4.2.3), Capability/Configuration2 Record Identifier and Extension 7 Record Identifier. 

MSP number: 

Contents: 

The MSP number contains the Profile Identity of the subscriber profile. The Profile Identity shall be between land 4 
as defined in TS 23.097 [36] for MSP. 

Coding: 
Binary. 

CFU indicator status: 

Contents: 

Indicates the status of the call forward unconditional indicator. Service code = 21 (CFU) or 002 (for CFU part of all 
CF), as defined in TS 22.030 [4] 

Coding: 

The indicator status for each indicator type is 1 bit long and is set as follows: 
bit = 1 : Set indication active 
bit = 0: Set indication inactive. 



B8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



CFU indicator status - Voice 

MM I Service code = 11 (Telephony) , as defined in TS 
22 . 030 [4] ) . 

CFU indicator status - Fax 

MM I Service code = 13 (Fax), as defined in TS 22.030 
[4] ) . 

CFU indicator status - All data teleservices 
MMI Service code = 12 (Data (Teleservices) ) , as 
defined in TS 22.030 [4]). 
CFU indicator status - SMS 

MMI Service code = 16 (SMS), as defined in TS 22.030 
[4] . 

CFU indicator status - All bearer services 

MMI Service code = 20 (Data (Bearer Services) ) , as 

defined in TS 22 . 030 [4] ) . 

RFU (e.g. for other MMI service codes) 
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4.2.65 EF EXT 7 (Extension?) 

This EF contains extension data of a CFIS (Call Forwarding Indication Status - see 4.2.64). 



Identifier: '6 FCC | 


Structure: 


linear fixed 




Optional 


Record length: 13 bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


1 1 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see clause 4.4.2.4 (EF EX ti)- 

4.2.66 EFspdi (Service Provider Display Information) 

If service n°51 is "available", this file shall be present. 

This EF contains information regarding the service provider display i.e. the service provider PLMN list. 



Identifier: '6FCD' 


| Structure: transparent 




Optional 


SFI: '1B' 




File size: x bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 tox 


TLV object(s) containing Service Provider 
information 


M 


x bytes 



Tag Value 


Tag Description 


'A3' 


Service provider display information Tag 


'80' 


Service provider PLMN list tag 



The service provider display information object is a constructed TLV coded according to ISO/IEC 8825-1 [35]. 

- Service provider PLMN list 
Contents: 

This TLV contains a list of n PLMNs in which the Service Provider Name shall be displayed, as defined in 
clause 4.2.12 (EF SPN ). 

Coding: 
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Description 


M/O 


Length 


Service provider PLMN list tag 


M 


1 byte 


Length (see note) 


M 


x bytes 


1 st PLMN entry 


M 


3 bytes 


2™ PLMN entry 


O 


3 bytes 


3 ra PLMN entry 


O 


3 bytes 








n m PLMN entry 





3 bytes 


Note: the length is 3*n bytes, where n denotes the number of PLMN entries. The length can 
be coded on one or more bytes according to ISO/I EC 8825-1 [35]. 



Each PLMN is coded as follows: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC) according to TS 24.008 [9]. 
In case a PLMN entry is not used, it shall be set to 'FF FF FF'. 

4.2.67 EF MMSN (MMS Notification) 

If service n°52 is "available", this file shall be present. 

This EF contains information in accordance with TS 23.140 [38] and X.S0016-000-A vl.O [45] comprising MMS 
notifications (and associated parameters) which have been received by the UE from the network. A 3GPP terminal 
needs only to support the MMS implementation specified in TS 23.140 [38]. 



Identifier: "6FCE" 


Structure: Linear fixed 


Optional 


Record length: 4+X bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 


PIN 
PIN 







DEACTIVATE ADM 
ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 2 


MMS Status 


M 


2 bytes 


3 


MMS Implementation 


M 


1 byte 


4 to X+3 


MMS Notification 


M 


X bytes 


X+4 


Extension file record number 


M 


1 byte 



- MMS Status 
Content: 

The status bytes contain the status information of the notification. 
Coding: 

bl indicates whether there is valid data or if the location is free. B2 indicates whether the MMS notification has been read 
or not. Bits b3-b4 of the first byte indicate the MM retrieval, MM rejection, or MM forwarding status, Bits b5-b8 of 
the first byte and the entire second byte are reserved for future use. 

First byte: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



X X X 
XXXI 
X X 1 
X X 1 1 
0X1 
1X1 
10X1 
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11X1 MM forwarded 

Reserved for future use 



Second byte: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 





















Reserved for future use 



- MMS Implementation 
Contents: 

The MMS Implementation indicates the used implementation type, e.g. WAP. 

Coding: 
Allocation of bits: 
Bit number Parameter indicated 

1 WAP implementation of MMS as defined in TS 23. 140 [38] 

2 Reserved for 3GPP2: M-IMAP implementation of MMS as defined in X.S0016-000-A vl .0 [45] 

3 Reserved for 3GPP2: SIP implementation of MMS as defined in X.S0016-000-A vl .0 [45] 
4-8 Reserved for future use 

Bit value Meaning 

Implementation not supported. 

1 Implementation supported. 

- MMS Notification 
Contents: 

The MMS Notification contains the MMS notification. 
Coding: 

The MMS Notification is coded according to the MMS Implementation as indicated in Byte 3. 
Any unused byte shall be set to 'FF'. 

- Extension file record number 
Contents: 

- extension file record number. This byte identifies the number of a record in the EF EX i8 containing extension data for the 
notification information. The use of this byte is optional. If it is not used it shall be set to FF'. 

Coding: 

- binary. 



4.2.68 EFexts (Extension 8) 

If service n°53 is "available", this file shall be present. 

This EF contains extension data of a MMS Notification (Multimedia Messaging Service - see 4.2.67). 



Identifier: '6FCF' ', 


Structure: linear fixed 




Optional 


Record length: X+2 bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 

ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Record type 


M 


1 byte 


2 toX+1 


Extension data 


M 


X bytes 


X+2 


Identifier 


M 


1 byte 



The structure of this EF is identical to the structure of EF EX ti (see clause 4.4.2.4). 
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- Record type. 
Contents: 

type of the record, see clause 4.4.2.4 
Coding: 

according to the "additional data" type 

- Extension data. 
Contents: 

additional data (MMS notification extension) 
Coding: 

the first byte of the extension data gives the number of bytes of the remainder of the MMS notification in this record. 
The following bytes contain the extension of the MMS notification. 

Identifier. 
Contents: 

identifier of the next extension record (in EXT8) to enable longer storage of information. 
Coding: 

record number of next record. 'FF' identifies the end of the chain. 

4.2.69 EF MMS icp (MMS Issuer Connectivity Parameters) 

If service n°52 is "available", this file shall be present. 

This EF contains values for Multimedia Messaging Connectivity Parameters as determined by the issuer, which can be 
used by the ME for MMS network connection. This file may contain one or more sets of Multimedia Messaging Issuer 
Connectivity Parameters. The first set of Multimedia Messaging Issuer Connectivity Parameters is used as the default 
set. Each set of Multimedia Messaging Issuer Connectivity Parameters may consist of one or more Interface to Core 
Network and Bearer information TLV objects, but shall contain only one MMS implementation TLV object, one MMS 
Relay/Server TLV object and one Gateway TLV object. The order of the Interface to Core Network and Bearer 
information TLV objects in the MMS Connectivity TLV object defines the priority of the Interface to Core Network 
and Bearer information, with the first TLV object having the highest priority. 



Identifier: '6FD0' 


Structure: Transparent 


Optional 


File Size: X1+...+ X n bytes 


Update activity: low 



Access Conditions: 



READ PIN 

UPDATE ADM 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes Description M/O Length 

1 to Xi MMS Connectivity Parameters TLV M Xi bytes 

object 

Xi+1toXi+X 2 MMS Connectivity Parameters TLV "~ O X 2 bytes 
object 



X1 + ...+ Xn-i+1 to X1 + ...+ X n MMS Connectivity Parameters TLV O X n bytes 
object | | 



MMS Connectivity Parameters tags 



Description 


Tag Value 


MMS Connectivity Parameters Tag 


'AB' 


MMS Implementation Tag 


"80" 


MMS Relay/Server Tag 


"81" 


Interface to Core Network and Bearer Information Tag 


'82' 


Gateway Tag 


'83' 


Reserved for 3GPP2: MMS Authentication Mechanism Tag 


'84' 


Reserved for 3GPP2: MMS Authentication User Name Tag 


'85' 
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Description 


Value 


M/O 


Length (bytes) 


MMS Connectivity Parameters Tag 


'AB' 


M 


1 


Length 


Note 1 


M 


Note 2 


MMS Implementation Tag 


'80' 


M 


1 


Length 


1 


M 


1 


MMS Implementation Information 


- 


M 


1 


MMS Relay/Server Tag 


'81' 


M 


1 


Length 


X1 


M 


Note 2 


MMS Relay/Server Address 


- 


M 


X1 


MMS Authentication Mechanism Tag 


'84' 


C1 


1 


Length 


X2 


C1 


Note 2 


MMS Authentication Mechanism 


- 


C1 


X2 


MMS Authentication User Name Tag 


'85' 


C1 


1 


Length 


X3 


C1 


Note 2 


MMS Authentication User Name 


-- 


C1 


X3 


1 st Interface to Core Network and 


'82' 


C2 


1 


Bearer Information Tag (highest priority) 








Length 


Y1 


C2 


Note 2 


1 st Interface to Core Network and 


- 


C2 


Y1 


Bearer information 








2™ Interface to Core Network and 


'82' 


C2 


1 


Bearer Information Tag 








Length 


Y2 


C2 


Note 2 


2™ Interface to Core Network and 


-- 


C2 


Y2 


Bearer information 
















N m Interface to Core Network and 


'82' 


C2 


1 


Bearer Information Tag (lowest priority) 








Length 


Y3 


C2 


Note 2 


N m Interface to Core Network and 




C2 


Y3 


Bearer information 








Gateway Tag 


'83' 


O 


1 


Length 


Z 


O 


Note 2 


Gateway Information 




O 


Z 


Note 1 : This is the total size of the constructed TLV object. 






Note 2: The length is coded according to ISO/IEC 8825-1 [35]. 

C1 : Reserved for 3GPP2: only present if M-IMAP or SIP indicated in tag 80. 


C2: Only present if WAP is indicated in tag 80. 







- MMS Implementation Tag '80' 

See section 4.2.67 for contents and coding. 

- MMS Relay/server Tag '8 1 ' 

Contents: 

The MMS relay/server contains the address of the associated MMS relay/server. 
Coding: 

The MMS relay/server address is coded according to the guideline provided in TS 23.140 [38]. 

- MMS Authentication Mechanism Tag '84' 

Contents: 

The MMS authentication mechanism contains the authentication mechanism used for M-IMAP and SIP. 
Coding: 

The MMS authentication mechanism is coded according to the guidelines provided in X.S0016-000-A vl.O [45]. 

- MMS Authentication User Name Tag '85' 

Contents: 

The MMS Authentication User Name contains the authentication user name used for M-IMAP and SIP. 
Coding: 

The MMS authentication User Name is coded according to the guidelines provided in X.S0016-000-A vl.O [45]. 

- Interface to Core Network and Bearer Information Tag '82' 
Contents: 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



73 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



The Interface to Core Network and Bearer Information may contain the following information to set up the bearer: 
Bearer, Address, Type of address, Speed, Call type, Authentication type, Authentication id, Authentication password. 
Coding: 

The coding is according to the guideline provided in TS 23.140 [38]. 

- Gateway Tag '83' 
Contents: 

The Gateway may contain the following information; Address, Type of address, Port, Service, Authentication type, 
Authentication id and Authentication password. 
Coding: 

The coding is according to the guideline provided in TS 23.140 [38]. 
Unused bytes shall be set to 'FF'. 

An Example for the coding of these parameters can be found in Annex J.2. 

4.2.70 EFmmsup (MMS User Preferences) 

If service n°52 is "available", this file shall be present. 

This EF contains values for Multimedia Messaging Service User Preferences, which can be used by the ME for user 
assistance in preparation of mobile multimedia messages (e.g. default values for parameters that are often used). 



Identifier: '6FD1' 


Structure: Linear Fixed 


Optional 


Record Length: X bytes 


Update activity: low 



Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


MMS User Preference TLV Objects 


M 


X bytes 



MMS User Preference tags 



Description 


Tag Value 


MMS Implementation Tag 


'80' 


MMS User preference profile name Tag 


'81' 


MMS User Preference information Tag 


'82' 



MMS User Preference information 



Description 


Value 


M/O 


Length (bytes) 


MMS Implementation Tag 


'80' 


M 


1 


Length 


1 


M 


Note 


MMS Implementation information 




M 


1 


MMS User preference profile name Tag 


'81' 


M 


1 


Length 


X 


M 


Note 


MMS User profile name 




M 


X 


MMS User Preference information Tag 


'82' 


M 


1 


Length 


Y 


M j 


Note 


MMS User Preference information 




M 


Y 


Note: The length is coded according to ISO/IEC 8825-1 [35] 



- MMS Implementation Tag '80' 
For contents and coding see 4.2.67 

MMS User preference profile name Tag '81' 
Contents: 

Alpha tagging of the MMS user preference profile. 
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Coding: 

this alpha-tagging shall use either: 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set to 0. The alpha identifier shall be left 
justified. 

Or: 

- one of the UCS2 coded options as defined in the annex ofTS 31.101 [11]. 



- MMS User Preference information Tag '82' 
Contents: 

The following information elements may be coded; Sender Visibility, Delivery Report, Read-Reply, Priority, Time of 
Expiry and Earliest Delivery Time. 
Coding: 

Depending upon the MMS implementation as indicated in Tag '80'. 
An Example for the coding of these parameters can be found in Annex J.l. 

4.2.71 EFmmsucp (MMS User Connectivity Parameters) 

If service n°52 and n°55 are "available", this file shall be present. 

This EF contains values for Multimedia Messaging Connectivity Parameters as determined by the user, which can be 
used by the ME for MMS network connection. This file may contain one or more sets of Multimedia Messaging User 
Connectivity Parameters. Each set of Multimedia Messaging User Connectivity Parameters may consist of one or more 
Interface to Core Network and Bearer information TLV objects, but shall contain only one MMS implementation TLV 
object, one MMS Relay/Server TLV object and one Gateway TLV object. The order of the Interface to Core Network 
and Bearer information TLV objects in the MMS Connectivity TLV object defines the priority of the Interface to Core 
Network and Bearer information, with the first TLV object having the highest priority. 



Identifier: '6FD2' 


Structure: Transparent 


Optional 


Fi le Size : Xi + . . . + X n bytes 


Update activity: low 



Access Conditions: 



READ PIN 
UPDATE PIN/PIN2 

(fixed during administrative management) 

DEACTIVATE ADM 



ACTIVATE 


ADM 






Bytes 


Description 


M/O 


Length 


1 to Xi 


MMS Connectivity Parameters TLV 
object 


O 


Xi bytes 


Xi+1 to Xi +X 2 


MMS Connectivity Parameters TLV 
object 


O 


X 2 bytes 










Xi + ...+ Xn-l + 1 to Xi + ...+ X n 


MMS Connectivity Parameters TLV 
object 


O 


X n bytes 



For the contents and coding see 4.2.69 



4.2.72 EF NIA (Network's Indication of Alerting) 

If service n°56 is "available", this file shall be present. 

This EF contains categories and associated text related to the Network's indication of alerting in the MS service defined 
in TS 22.101 [24]. 
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Identifier: '6FD3' 


Structure: linear fixed 


Optional 


Record length : X+1 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Alerting category 


M 


1 byte 


2 to X+1 


Informative text 


M 


X bytes 



- Alerting category 
Contents: 

category of alerting for terminating traffic. 

Coding: 

according to TS 24.008 [9]. Value 'FF' means that no information on alerting category is available. 
Informative text 
Contents: 

text describing the type of terminating traffic associated with the category. 

Coding: 

see the coding of the Alpha Identifier item of the EF ADN . The maximum number of characters for this 
informative text is indicated in TS 22.101 [24]. 

4.2.73 EFvgcs (Voice Group Call Service) 

If service n°57 is "available", this file shall be present. 

This EF contains a list of those VGCS group identifiers the user has subscribed to. The elementary file is used by the 
ME for group call establishment and group call reception. 



Identifier: '6FB1' 


Structure: transparent 


Optional 


File size: 4n bytes, (1< n < 50) 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 to 4 


Group ID 1 


M 


4 bytes 


5 to 8 


Group ID 2 


O 


4 bytes 










(4n-3) to 4n 


Group ID n 


O 


4 bytes 



- Group ID 

Contents: VGCS Group ID, according to TS 23.003 [25] 
Coding: 

The VGCS Group ID is of a variable length with a maximum length of 8 digits. Each VGCS Group ID is 
coded on four bytes, with each digit within the code being coded on four bits corresponding to BCD code. 
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If a VGCS Group ID of less than 8 digits is chosen, then the unused nibbles shall be set to 'F. VGCS 
Group ID Digit 1 is the most significant digit of the Group ID. 



Byte 1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 1 of Group ID 1 



MSB of Digit 1 of Group ID 1 
LSB of Digit 2 of Group ID 1 



MSB of Digit 2 of Group ID 1 



Byte 2: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 3 of Group ID 1 



MSB of Digit 3 of Group ID 1 
LSB of Digit 4 of Group ID 1 



MSB of Digit 4 of Group ID 1 



Byte 3: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 5 of Group ID 1 



MSB of Digit 5 of Group ID 1 
LSB of Digit 6 of Group ID 1 



MSB of Digit 6 of Group ID 1 



Byte 4: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 7 of Group ID 1 



MSB of Digit 7 of Group ID 1 
LSB of Digit 8 of Group ID 1 



MSB of Digit 8 of Group ID 1 



: etc 

Byte (4n-3) to 4n: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 7 of Group ID n 



MSB of Digit 7 of Group ID n 
LSB of Digit 8 of Group ID n 



MSB of Digit 8 of Group ID n 
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If storage for fewer than the maximum possible number n of VGCS Group Ids, is required, the excess 
bytes shall be set to 'FF. 



4.2.74 EFvgcss (Voice Group Call Service Status) 

If service n°57 is "available", this file shall be present. 

This EF contains the status of activation for the VGCS group identifiers. The elementary file is directly related to the 
EFvgcs- This EF shall always be allocated if EF V gcs is allocated. 



Identifier: '6FB2' 


Structure: transparent 


Optional 


File size: 7 bytes 


Update activity: low 



Access Conditions: 
READ 
UPDATE 

INVALIDATE 
REHABILITATE 



PIN 

PIN/ADM 

(fixed during administrative management) 

ADM 

ADM 



Bytes 


Description 


M/O 


Length 


1 to 7 


Activation/Deactivation Flags 


M 


7 bytes 



Activation/Deactivation Flags 



Contents: 
Coding: 



Byte 1: 



Activation/Deactivation Flags of the appropriate Group Ids 
bit = means - Group ID deactivated 
bit = 1 means - Group ID activated 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Group ID 1 



Group ID 8 



etc 

Byte 7: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Group ID 4 9 
Group ID 5 

"b3 = l 

"b4 = l 

"b5=l 

"b6=l 

"b7=l 

"b8=l 



4.2.75 EFvbs (Voice Broadcast Service) 

If service n°58 is "available", this file shall be present. 

This EF contains a list of those VBS group identifiers the user has subscribed to. The elementary file is used by the ME 
for broadcast call establishment and broadcast call reception. 
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Identifier: '6FB3' 


Structure: transparent 


Optional 


File size: 4n bytes, (1 < n < 50) 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 to 4 


Group ID 1 


M 


4 bytes 


5 to 2 


Group ID 2 


O 


4 bytes 










(4n-3) to 4n 


Group ID n 


O 


4 bytes 



Group ID 

Contents: VBS Group ID, according to TS 23.003 [25] 

Coding: The VBS Group ID is of a variable length with a maximum length of 8 digits. Each VBS Group ID 

is coded on four bytes, with each digit within the code being coded on four bits corresponding to 
BCD code. If a VBS Group ID of less than 8 digits is chosen, then the unused nibbles shall be set 
to 'F'. VBS Group ID Digit 1 is the most significant digit of the Group ID. 

Byte 1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 1 of Group ID 1 



MSB of Digit 1 of Group ID 1 
LSB of Digit 2 of Group ID 1 



MSB of Digit 2 of Group ID 1 



Byte 2: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 3 of Group ID 1 



MSB of Digit 3 of Group ID 1 
LSB of Digit 4 of Group ID 1 



MSB of Digit 4 of Group ID 1 



Byte 3: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 5 of Group ID 1 



MSB of Digit 5 of Group ID 1 
LSB of Digit 6 of Group ID 1 



MSB of Digit 6 of Group ID 1 
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Byte 4: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



| LSB of Digit 7 of Group ID 1 

MSB of Digit 7 of Group ID 1 
LSB of Digit 8 of Group ID 1 

MSB of Digit 8 of Group ID 1 

: etc 

Byte (4n-3) to 4n: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 7 of Group ID n 



MSB of Digit 7 of Group ID n 
LSB of Digit 8 of Group ID n 



MSB of Digit 8 of Group ID n 



If storage for fewer than the maximum possible number n of VBS Group Ids, is required, the excess bytes shall be set to 
'FF. 

4.2.76 EFvbss (Voice Broadcast Service Status) 

If service n°58 is "available", this file shall be present. 

This EF contains the status of activation for the VBS group identifiers. The elementary file is directly related to the 
EFvbs- This EF shall always be allocated if EF V bs is allocated. 



Identifier 


'6FB4' 


Structure: transparent 


Optional 


File size: 7 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 

INVALIDATE 
REHABILITATE 


PIN 

PIN/ADM 

(fixed during administrative management) 

ADM 

ADM 


Bytes 


Description 


M/O 


Length 


1 to 7 


Activation/Deactivation Flags 


M 


7 bytes 



Activation/Deactivation Flags 

Contents: Activation/Deactivation Flags of the appropriate Group Ids 

Coding: see coding of EF V gcss 



ETSI 



3GPPTS 31.102 version 11.3.0 Release 11 80 ETSITS131 102 V1 1.3.0 (2012-10) 

4.2.77 EFvgcsca (Voice Group Call Service Ciphering Algorithm) 

If service n°64 is "available", this file shall be present. 

This EF contains the ciphering algorithm identifiers for each of the Master Group Key (V_Ki) of each VGCS group that 
the user has subscribed to (defined in EF V gcs)- 



Identifier: '6FD4' 


Structure: transparent 


Optional 


File size: 2n bytes, (1 < n < 50) 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/O 


Length 


1 


VGCS Group ciphering algorithm identifier for 
1 st V_Ki of Group 1 


M 


1 byte 


2 


VGCS Group ciphering algorithm identifier for 
2 nd V_Ki of Group 1 


M 


1 byte 


3 


VGCS Group ciphering algorithm identifier for 
1 st V_Kiof Group 2 


O 


1 byte 


4 


VGCS Group ciphering algorithm identifier for 
2 nd V_Ki of Group 2 


O 


1 byte 










2n-1 


VGCS Group ciphering algorithm identifier for 
1 st V_Ki of Group n 


O 


1 byte 


2n 


VGCS Group ciphering algorithm identifier for 
2 nd V_Ki of Group n 


O 


1 byte 



Ciphering Algorithm Identifier: 

Contents: Ciphering Algorithm identifier for the specified Master Group Key of each Voice Call Group 
Coding: 

Value 

"00" no ciphering 

"01" ciphering with algorithm GSM A5/1 
"02" ciphering with algorithm GSM A5/2 
"03" ciphering with algorithm GSM A5/3 
"04" ciphering with algorithm GSM A5/4 
"05" ciphering with algorithm GSM A5/5 
"06" ciphering with algorithm GSM A5/6 
"07" ciphering with algorithm GSM A5/7 
"08" to "FF" RFU 
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4.2.78 EFvbsca (Voice Broadcast Service Ciphering Algorithm) 

If service n°65 is "available", this file shall be present. 

This EF contains the ciphering algorithm identifiers for each of the Master Group Key (V_Ki) of each VBS group that 
the user has subscribed to (defined in EF V bs)- 



Identifier: '6FD5' 


Structure: transparent 


Optional 


File size: 2n bytes, (1 < n < 50) 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
INVALIDATE ADM 
REHABILITATE ADM 


Bytes 


Description 


M/O 


Length 


1 


VBS Group ciphering algorithm identifier for 1 st 
V_Ki of Group 1 


M 


1 byte 


2 


VBS Group ciphering algorithm identifier for 
2 nd V_Ki of Group 1 


M 


1 byte 


3 


VBS Group ciphering algorithm identifier for 1 st 
V_Ki of Group 2 


O 


1 byte 


4 


VBS Group ciphering algorithm identifier for 
2 nd V_Ki of Group 2 


O 


1 byte 










2n-1 


VBS Group ciphering algorithm identifier for 1 st 
V_Ki of Group n 


O 


1 byte 


2n 


VBS Group ciphering algorithm identifier for 
2 nd V_Ki of Group n 


O 


1 byte 



Ciphering Algorithm Identifier: 

Contents: Ciphering Algorithm identifier for the specified Master Group Key of each Voice Broadcast Group 

Coding: See coding of EF V gcsca 

4.2.79 EFqbabp (GBA Bootstrapping parameters) 

If service n°68 is "available", this file shall be present. 

This EF contains the AKA Random challenge (RAND) and Bootstrapping Transaction Identifier (B-TID) associated 
with a GBA bootstrapping procedure. 



Identifier: '6FD6' Structure: transparent 




Optional 


File length: L+X+N+3 bytes i Update activity: low 


Access Conditions 








READ 


PIN 






UPDATE 


PIN 






DEACTIVATE ADM 






ACTIVATE 


ADM 






Bytes 


Description 


M/O 


Length 


1 


Length of RAND (X) 


M 


1 byte 


2 to (X+1) 


RAND 


M 


X bytes 


X+2 


Length of B-TID (L) 


M 


1 byte 


(X+3) to (X+2+L) 


B-TID 


M 


L bytes 


X+L+3 


Length of key lifetime 


M 


1 byte 


(X+L+4) to 


Key lifetime 


M 


N bytes 


(X+L+N+3) 









Length of RAND 

Contents: number of bytes, not including this length byte, of RAND field 
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RAND 



Contents: Random challenge used in the GBA_U bootstrapping procedure. 

Coding: as defined in TS 33.103 [13] 

Length of B-TID 

Contents: number of bytes, not including this length byte, of B-TID field 
B-TID 



Content: Bootstrapping Transaction Identifier the GBA_U bootstrapped keys 

Coding: As defined in TS 33.220 [42] 

Length of key lifetime 

Contents: number of bytes, not including this length byte, of key lifetime field 

Key lifetime 

Content: Lifetime of the GBA_U bootstrapped keys 

Coding: As defined in TS 33.220 [42] 



4.2.80 EFmsk (MBMS Service Keys List) 

If service n°69 is "available", this file shall be present. 

A record of this EF contains the list of MBMS Service Keys (MSK) and associated parameters, which are related to an 
MBMS Key Domain. There are up to two MSKs per Key Domain ID/Key Group ID pair, where the Key Group ID is 
the Key Group part of the MSK ID as defined in TS 33.246 [43]. Two 4 byte MSK IDs stored within a record have the 
same value for the 2 byte Key Group part. 



Identifier: '6FD7' | Structure: linear fixed | Optional 



Record length: 8n+4 bytes, (n > 2) | Update activity: low 



Access Conditions: 

READ PIN 

UPDATE ADM 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


Key Domain ID 


M 


3 bytes 


4 


Number of stored MSK IDs and 
corresponding TS 


M 


1 byte 


5 to 8 


1 st MSK ID 


M 


4 bytes 


9 to 12 


1 st Time Stamp Counter (TS) 


M 


4 bytes 


1 3 to 1 6 


2™ MSK ID 


M 


4 bytes 


17 to 20 


2™ Time Stamp Counter (TS) 


M 


4 bytes 










8(n-1)+5 to 8n 


n tn MSK ID 


O 

(See Note) 


4 bytes 


8n+1 to 8n+4 


n m Time Stamp Counter (TS) 


C 

(See Note) 


4 bytes 



Note: In the current version of the specification, these bytes are RFU. 



Key Domain ID: 

Content: Identifier of the Domain of the BM-SC providing MBMS Service. 

Coding: As defined in TS 33.246 [43] 
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Number of stored MSK IDs and corresponding TS: 

Content: Number of stored MSK IDs and corresponding Time Stamp counter (TS) within the record, as defined in 
TS 33.246 [43]. This number shall not exceed the maximum limit of MSK IDs fixed in TS 33.246 [43] (e.g if the 
maximum number of MSK IDs is 2, then this byte may only take the following values: '00', '01', '02'). 
Coding: binary. 

MSK ID: 



Content: Identifier of MBMS Service Key (MSK) within a particular Key Domain. 

Coding: As defined in TS 33.246 [43] 



Time Stamp Counter (TS) 
Content: 
Coding: 

Any unused bytes shall be set to 'FF' 



Counter for MIKEY replay protection in MTK delivery. Each counter is associated with a 
particular MSK. 
As defined in TS 33.246 [43] 



4.2.81 EFmuk (MBMS User Key) 

If service n°69 is "available", this file shall be present. 

This EF contains the identifier of the MBMS User Key (MUK) that is used to protect the transfer of MBMS Service 
Keys (MSK). The file also contains the Time Stamp Counter associated with the MUK, which is used for Replay 
Protection in MSK transport messages. This EF shall not contain MUK IDs with the same Idi part. 



Identifier: '6FD8' 



Structure: linear fixed 



Record length: Z bytes 



Optional 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Bytes 


1 toZ 


MBMS User Key TLV objects 


M 


1 toZ 



MBMS User Key tags 



MBMS User Key information 



Description 


Tag Value 


MUK ID Tag 


'AO' 


Time Stamp Counter Tag 


'81' 



Description 


Value 


M/O 


Length (bytes) 


MUK ID Tag 


'AO' 


M 


1 


Length 


X 


M 


Note 


MUK Idr Tag 


'80' 


M 


1 


Lenght 


A 


M 


Note 


MUK Idr value 




M 


A 


MUK Idi Tag 


'82' 


M 


1 


Lenght 


W 


M 


Note 


MUK Idi Value 




M 


W 


Time Stamp Counter Tag 


'81' 


M 


1 


Length 


Y 


M 


Note 


Time Stamp Counter value 




M 


Y 


Note: The length is coded according to ISO/IEC 8825-1 [35] 



MUK ID Tag AO'. This constructed data object consists of the Idr, and the Idi 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



84 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



- Idr Tag '80' 
Content: 

Idr part of MBMS User Key (MUK). 
Coding: 

As defined in TS 33.246 [43] 

- Idi Tag '82' 
Content: 

Idi part of MBMS User Key (MUK). 
Coding: 

As defined in TS 33.246 [43] 

- Time Stamp Counter Tag '81' 
Content: 

Counter for MIKEY replay protection in MSK delivery. The counter is associated with the particular MUK. The 
length value is defined in TS 33.246 [43]. 
Coding: 

As defined in TS 33.246 [43] 
Unused bytes shall be set to 'FF'. 

4.2.82 Void 

4.2.83 EFqbanl (GBA NAF List) 

If service n°68 is "available", this file shall be present. 

This EF contains the list of NAF_ID and B-TID associated to a GBA NAF derivation procedure. 



Identifier: '6FDA' 



Structure: Linear fixed 



Optional 



Record length: Z bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toZ 


NAF Key Identifier TLV objects 


M 


Z bytes 



NAF Key Identifier tags 



Description 


Tag Value 


NAF_ID Tag 


'80' 


B-TID Tag 


'81' 



NAF Key Identifier information 



Description 


Value 


M/O 


Length (bytes) 


NAF ID Tag 


'80' 


M 


1 


Length 


X 


M 


Note 


NAF ID value 




M j 


X 


B-TID Tag 


'81' 


M 


1 


Length 


Y 


M 


Note 


B-TID value 




M 


Y 


Note: The length is coded according to ISO/IEC 8825-1 [35] 



NAF_ID Tag '80' 
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Contents: 

Identifier of Network Application Function used in the GBA_U NAF Derivation procedure. 
Coding: 

As defined in TS 33.220 [42] 

- B-TID Tag '81' 
Content: 

Bootstrapping Transaction Identifier of the GBA_U bootstrapped key 
Coding: 

As defined in TS 33.220 [42] 
Unused bytes shall be set to 'FF' 

4.2.84 EFehplmn (Equivalent HPLMN) 

If service n°71 is "available", this file shall be present. 

This EF contains the coding for n EHPLMNs. The usage of EHPLMN is defined in TS 23.122 [31]. This data field may 
contain the HPLMN code derived from the IMSI as an EHPLMN entry. 



Identifier: '6FD9' 


Structure: transparent 


Optional 


SFI: '1D' 




File size: 3n, (n >1) 


Update activity: low 



Access Conditions: 

READ PIN 

UPDATE ADM 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


1 st EHPLMN (highest priority) 


M 


3 bytes 


4 to 6 


2 na EHPLMN 


O 


3 bytes 










(3n-2) to (3n) 


n tn EHPLMN (lowest priority) 


O 


3 bytes 



- EHPLMN 
Contents: 

- Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

- according to TS 24.008 [9]. 
Unused entries shall be set to FF FF FF' 

4.2.85 EF E hplmnpi (Equivalent HPLMN Presentation Indication) 

If service n°71 and service n°73 are "available", this file shall be present. 

This EF contains an indication to the ME for the presentation of the available EHPLMN(s). The usage of the EHPLMN 
presentation indication is defined in TS 23.122 [31]. 



Identifier: '6FDB' | 


Structure: transparent 




Optional 


File size: 1 byte 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 










Bytes 


Description 


M/O 


Length 


1 


EHPLMN Presentation Indication 


M 


1 byte 
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- EHPLMN Presentation Indication: 

Contents: 
EHPLMN display mode 
Coding: 

'00' - No preference for the display mode 

'01 ' - Display the highest-priority available EHPLMN only 

- '02' - Display all the available EHPLMNs 

- All other values are RFU 

4.2.86 EFlrrlmnsi (Last RPLMN Selection Indication) 

If service n°74 is "available", this file shall be present. 

This EF contains an indication to the ME for the selection of the RPLMN or the home network at switch on, or 
following recovery from lack of coverage. The usage of the Last RPLMN Selection Indication is defined in 
TS 23.122 [31]. 



Identifier: '6FDC ! 


Structure: transparent 




Optional 


File size: 1 byte 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 










Bytes 


Description 


M/O 


Length 


1 


Last RPLMN Selection Indication 


M 


1 byte 



- Last RPLMN Selection Indication: 

Contents: 
Last RPLMN Selection Indication 
Coding: 

- '00' - The UE shall attempt registration on the last RPLMN as described in TS 23.122 [31] 

- '01' - The UE shall attempt registration on the home network as described in TS 23. 122 [31] 

- All other values are RFU 

4.2.87 EF N afkca (NAF Key Centre Address) 

If service n°68 and service n°76 are "available", this file shall be present. 

This EF contains one or more NAF Key Centre addresses. The first record in the EF shall be considered to be of the 
highest priority. The last record in the EF shall be considered to be the lowest priority. 



Identifier: '6FDD' 



Structure: Linear fixed 



Optional 



Record length: Z bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toZ 


NAF Key Centre TLV object 


M 


Z bytes 



Unused bytes shall be set to FF'. 
NAF Key Centre tags 



Description 


Tag Value 


NAF Key Centre address Tag 


■80' 
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Description 


Value 


M/O 


Length (bytes) 


NAF Key Centre address Tag 


■80' 


M 


1 


Length 


X 


M 


Note 


NAF Key Centre address value 




M 


X 


Note: The length is coded according to ISO/IEC 8825-1 [35]. 



- NAF Key Centre Address value (Tag '80') 
Contents: 

Fully qualified Domain Name (FQDN) of the NAF Key Centre used in the Local Key Establishment 
procedures (see TS 33.110 [47]). 

Coding: 

Encoded to an octet string according to UTF-8 encoding rules as described in IETF RFC 3629 [48]. 

4.2.88 EFspni (Service Provider Name Icon) 

If service n°78 is "available", this file shall be present. 

This EF may contain one or several links to the service provider name icon. When more than one link is available, it is 
up to the ME to choose the link type to be used (e.g. the link type that is supported by the ME). The requirements for 
the display by the ME are defined in section 4.2. 12. 



Identifier: '6FDE' j 


Structure: transparent 




Optional 


File Size: X bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


ALWAYS 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 toX 


Icon TLV object(s) 


M 


X bytes 



This file may contain one or several service provider name Icon TLV object(s). The coding of the service provider name 
Icon TLV objects is described hereafter: 



Length 


Description 


Value 


Status 


1 byte 


Icon Tag (See Note 1) 




M 


1 byte 


Length (see Note 2) 


Y+1 


M 


1 byte 


Icon Qualifier 




M 


Y bytes 


Icon Link 




M 


Note 1 : The tag value indicates the type and format of the Icon Link that is provided in the TLV value 
field (e.g. Tag '80' indicates that the Icon link is a URI, while Tag '81' indicates that the Icon Link is the 




record number of the corresponding image in EFimg). 
Note 2: coded according to ISO/IEC 8825-1 [35]. 





Icon Tag 

Contents: Tag value. 

- When the Icon Link is an URI, the Tag value shall be set to '80'. 

- When the Icon Link is a pointer to the record number of the corresponding image in EF IMG , the Tag value 
shall be set to '81'. 

- All other values are RFU. 

Coding: binary. 
- Icon Qualifier 
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Contents: The icon qualifier indicates to the ME how the icon shall be used. 

- '01' = icon is self-explanatory, i.e. if displayed, it replaces the corresponding name in text format. 

- '02' = icon is not self-explanatory, i.e. if displayed, it shall be displayed together with the corresponding 

name in text format. 

- All other values are RFU. 
Coding: binary. 

Icon Link 

Contents: Link to the icon. This link shall point to a UICC resource. 
Coding: 

- When the Tag value indicates an URI (i.e. Tag = '80') , the Icon Link shall be encoded to an octet string 
according to UTF-8 encoding rules as described in IETF RFC 3629 [48] (e.g. 
http://127.0.0.1:3516/pub/files/spng.ipg) . 

- When the Tag value indicates that the Icon Link contains the record number of the corresponding image in 
EFmio (i-e. Tag = '81'), the Icon Link shall be encoded in binary. 

4.2.89 EFpmni (PLMN Network Name Icon) 

If service n°79 is "available", this file shall be present. 

This EF contains one or several links to the PLMN network name icon. When more than one link is available in a 
record, it is up to the ME to choose the link type to be used (e.g. the link type that is supported by the ME). 



Identifier: '6FDF' ] 


Structure: 


linear fixed 




Optional 


Record length: X bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


ALWAYS 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 toX 


Icon TLV object(s) 


M 


X bytes 



Each record may contain one or several PLMN network name Icon TLV object(s). The coding of the Icon TLV 
object(s) is described in EF S pni- 

4.2.90 EF N cp-ip (Network Connectivity Parameters for USIM IP connections) 

If service n°80 is "available", this file shall be present. 

This EF contains the network activation parameters to be used by the ME for establishing a data channel (e.g. PDP 
context activation) for UICC remote IP connectivity as described in ETSI TS 102 483 [50]. 

Each record contains a network connectivity parameters set. A network connectivity parameters set may comprise an 
Access Point Name, a Login and Password of the Access Point Name, a Data Destination Address Range and the Bearer 
Description. The priority order of the different Network Connectivity Parameters sets is the same as the order of the 
record numbers. 

Each network connectivity parameters set provides a condition and the network connectivity parameters to be used 
when this condition is met: 

The network activation parameters present in a record shall be associated with this Data Destination Address 
Range in the same record (i.e. if a record contains a Data Destination Address Range, all IP packets that are sent 
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by the UICC to any network destination address belonging to this Address Range shall transit through a network 
connection established using the parameters provided in that record). 

Note: A Data Destination Address Range TLV with a zero length prefix matches all addresses of the 
address type. 

In a record, if the Access Point Name has a value part, the associated Login and Password may be provided. If 
supported by the ME, the Login and Password may be used for Access Point Name authentication. If only the Login is 
present, the ME shall use its default Password configuration if any. If the Login and Password are not present, the ME 
shall use its default Login/Password configuration if any. If no authentication is requested, the Login and Password 
shall be ignored. The Password TLV can only be provided in a record if a Login TLV is provided in the same record. 

In any record, if the Access Point Name has no value part, the ME may use its default Access Point Name or the default 
subscription value together with the other network connectivity parameters of that record. 

When present, the Bearer Description TLV provides recommended values for parameters that the ME should use to 
establish the data link for UICC remote IP connections. However if the ME or network does not support these values, 
the ME selects the most appropriate values. 



Structure of EF NC p-ip 



Identifier: '6FE2' | Structure: I 


near fixed 




Optional 


Record length: Z bytes [ 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 to M 


Data Destination Address Range TLV 


M 


M bytes 


M+1 to M+N 


Access Point Name TLV 


M 


N bytes 


M+N+1 to 
M+N+O 


Login TLV 


C 


O bytes 


M+N+O+1 to 
M+N+O+P 


Password TLV 


C 


P bytes 


M+N+O+P+1 
to 

M+N+O+P+Q 


Bearer description TLV 




C 


Q bytes 











Access Point Name TLV 

Contents: Access Point Name provides information to the ME necessary to identify the Gateway entity which 
provides interworking with an external packet data network. 

Coding: the coding of the Access Point Name TLV object is described hereafter. The Access Point Name 
Value is coded as defined in TS 23.003 [25]. 



Length 


Description 


Value 


Status 


1 byte 


Access Point Name Tag 


80 


M 


1 byte 


Length (see note 1) 


X 


M 


1 byte 


Access Point Name Value 




M 


Note 1 : coded according to ISO/IEC 8825-1 [35]. 



- Login TLV 

Contents: the login of the Access Point Name. 

Coding: the coding of the Login TLV object is described hereafter. The Login Value is coded as for SMS Data 
coding scheme defined in TS 23.038 [5]. Parts of the data coding scheme other than the character set 
indication shall be ignored. 
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Length 


Description 


Value 


Status 


1 byte 


Login Tag 


81 


M 


1 byte 


Length (see note 1) 


X 


M 


1 byte 


Login Value 




M 


Note 1 : coded according to ISO/IEC 8825-1 [35]. 



- Password TLV 

Contents: the password of the Access Point Name. 

Coding: the coding of the Password TLV object is described hereafter. The Password Value is coded as for 
SMS Data coding scheme defined in TS 23.038 [5]. Parts of the data coding scheme other than the 
character set indication shall be ignored. 



Length 


Description 


Value 


Status 


1 byte 


Password Tag 


82 


M 


1 byte 


Length (see note 1) 


X 


M 


1 byte 


Password Value 




M 


Note 1 : coded according to ISO/IEC 8825-1 [35]. 



- Data Destination Address Range TLV 

Contents: the data destination address or the range of data destination addresses. 

Coding: the coding of the Data Destination Address Range TLV object is described hereafter. 



Length 


Description 


Value 


Status 


1 byte 


Data Destination Address Range Tag 


83 


M 


1 byte 


Length (see notel) 


X 


M 


1 byte 


Type of Address 




M 


1 byte 


Prefix length (in bits) 


'00' to 
'20' for 

Ipv4 
'00' to 
'80' for 

Ipv6 


M 


Oto 16 
bytes 


Prefix 






Note 1 : coded according to ISO/IEC 8825-1 [35]. 



Type of Address 

Contents: the type of data destination address range. 
Coding: 

- '21' = Ipv4 address range; 

- '57' = Ipv6 address range; 

- Other values are RFU. 
- Prefix length 

Contents: the number N of valid bits of the prefix of the address range. A prefix length of zero denotes the 
default "all IP addresses" range. 

Coding: binary 

Prefix 

Contents: Prefix, i.e. the leftmost bits of the address range. All addresses where the leftmost N bits match 
the prefix belong to the address range. 

Coding: 
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the leftmost N bits encode the prefix of the address range. If N is not an integer multiple of 8, the 
prefix is right padded with zeroes to the next octet boundary. 



- Bearer Description TLV 
Contents: bearer description. 

Coding: the coding of the Bearer Description TLV object is described hereafter. The Bearer Description Value 
is encoded as the value part of the "Bearer description" TLV data object defined in TS 31.111 [12]. 



Length 


Description 


Value 


Status 


1 byte 


Bearer Description Tag 


84 


M 


1 byte 


Length (see note 1) 


X 


M 


1 byte 


Bearer Description Value 




M 


Note 1 : coded according to ISO/IEC 8825-1 [35]. 



Any unused bytes shall be set to 'FF'. 



4.2.91 EFersloci (EPS location information) 

If service n°85 is "available", this file shall be present. 
This EF contains the following EPS location information: 

- Globally Unique Temporary Identifier (GUTI); 
Last visited registered Tracking Area Identity (TAI); 

- EPS update status. 



Identifier: '6FE3' | 


Structure: transparent 




Optional 


SFI: '1E' 




File size: 18 bytes 


Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 










Bytes 


Description 


M/O 


Length 


1 to 12 


GUTI 


M 


1 2 bytes 


13 to17 


Last visited registered TAI 


M 


5 bytes 


18 


EPS update status 


M 


1 byte 



- GUTI. 
Contents: 



Globally Unique Temporary Identifier. 
Coding: 

as the GUTI part of the EPS mobile identity information element defined in TS 24.301 [51]. Byte 1 
corresponds to "octet 2" of an EPS mobile identity information element containing a GUTI. Byte 12 
corresponds to "octet 13" of an EPS mobile identity information element information element containing 
a GUTI. 



Byte 1: first byte of GUTI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



i — — r 

MSB 



Last visited registered TAI 
Contents: 
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Last visited registered Tracking Area Identity. 
Coding: 

as the content of the tracking area identity information element defined in TS 24.301 [51]. Byte 13 

corresponds to "octet 2" of a tracking area identity information element. Byte 17 corresponds to "octet 6" 
of a tracking area identity information element. 

Byte 13: first byte of last visited registered TAI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



— i — — r 

MSB 



- EPS update status. 
Contents: 

status of EPS update according to TS 24.301 [51]. 
Coding: 

byte 18: 



b3 


b2 


bl. 













: UPDATED. 








1 


: NOT UPDATED. 





1 





: ROAMING NOT ALLOWED. 





1 


1 


: reserved. 


1 








: reserved. 


1 





1 


: reserved. 


1 


1 





: reserved. 


1 


1 


1 


: reserved. 



Bitsb4tob8 areRFU(see TS 31.101 [11]). 
Unused bytes shall be set to EE'. 
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4.2.92 EF E ps N sc (EPS NAS Security Context) 

If service n°85 is "available", this file shall be present. 

This EF contains the EPS NAS Security context as defined in TS 33.401 [52]. This file shall contain only one record. 



Identifier: '6FE4' 


Structure: linear fixed 


Optional 


SFI: '18' 




Record size: X bytes (X>54) 


Update activity: high 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


EPS NAS Security Context TLV Object 


M 


X bytes 



EPS NAS Security Context tags 



Description 


Tag Value 


EPS NAS Security Context Tag 


'AO' 



EPS NAS Security Context information 



Description 


Value 


M/O 


Length (bytes) 


EPS NAS Security Context Tag 


'AO' 


M 


1 


Length (length of all subsequent data) 


Y 


M j 


Note 1 


Key set identifier KSIasme Tag 


'80' 


M 


1 


Length 


K 


M 


Note 1 


Key set identifier KSIasme 




M 


K 


ASME key (K AS me) Tag 


'81' 


M 


1 


Length 


L 


M 


Note 1 


ASME key (K AS me) 




M 


L 


Uplink NAS count Tag 


'82' 


M 


1 


Length 


M 


M 


Note 1 


Uplink NAS count 




M 


M 


Downlink NAS count Tag 


'83' 


M 


1 


Length 


N 


M 


Note 1 


Downlink NAS count 




M 


N 


Identifiers of selected NAS integrity and 


'84' 


M 


1 


encryption algorithms Tag 








Length 


S 


M 


Note 1 


Identifiers of selected NAS integrity and 




M 


S 


encryption algorithms 








Note 1 : The length is coded according to ISO/IEC 8825-1 [35] 



Key set identifier KSI AS me Tag '80' 
Contents: 

The ASME key set identifier as defined in TS 33.401 [52]. In this release the KSIasme is coded on 1 byte. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

















KS Iasme 

bits b4 to b8 are coded 



ASME key (K ASME ) Tag '8 1 ' 
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Contents: 

The ASME Key as defined in TS 33.401 [52]. In this release a valid ASME key is coded on 32 bytes. The 
ME shall treat any ASME key values stored in this EF as invalid if the ASME key set identifier indicates 
that no ASME key is available or if the length indicated in the ASME key TLV is set to '00', 

Coding: 

The most significant bit of K A sme is the most significant bit of the 1 st byte of this TLV value field. The least 
significant bit of K ASME is the least significant bit of the last byte of this TLV value field. 

- Uplink NAS count Tag '82' 
Contents: 

The uplink NAS count as defined in TS 33.401 [52]. In this release the Uplink NAS count is coded on 4 
bytes. 

Coding: 

The most significant bit of the uplink NAS count is the most significant bit of the 1 st byte of this TLV value 
field. The least significant bit of the uplink NAS count is the least significant bit of the last byte of this 
TLV value field. 

- Downlink NAS count Tag '83' 
Contents: 

The downlink NAS count as defined in TS 33.401 [52]. In this release the downlink NAS count is coded on 4 
bytes. 

Coding: 

The most significant bit of the downlink NAS count is the most significant bit of the 1 st byte of this TLV 
value field. The least significant bit of the downlink NAS count is the least significant bit of the last byte 
of this TLV value field. 

- Identifiers of selected NAS integrity and encryption algorithms Tag '84' 
Contents: 

The identifiers of selected NAS integrity and encryption algorithms as defined in TS 33.401 [52] and TS 
24.301 [51]. In this release the identifiers of selected NAS integrity and encryption algorithms are coded 
on 1 byte. 

Coding: 

as the content of the NAS security algorithms information element defined in TS 24.301 [51]. 
Byte 1 of this TLV value field: first byte of the NAS security algorithms information element 



b8 


hi 


b6 


b5 


b4 


b3 


b2 


bl 



— I — — I — — I — — I — — I — — I — — I — — I — 

MSB 

Unused bytes shall be set to 'FF'. 

In order to mark the stored EPS NAS security context as invalid, the record bytes shall be set to FF'. 

4.2.93 EF UFC (USAT Facility Control) 

This EF contains data for USAT Facility Control related to AT commands for USAT (see TS 3 1 . 1 1 1 [12]). 
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Identifier: '6FE6' j 


Structure: transparent 




Optional 


File size: X bytes, (X > 1, 


| 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


ALW 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 toX 


Facility list 


M 


X bytes 



The facility list has the same format as the TERMINAL PROFILE defined in TS 31.1 1 1 [12]. 

By setting the corresponding bits to 1, the facility list defines facilities which can only be provided by the MT and 
which are not allowed to be provided by the TE. 

If a TERMINAL PROFILE is longer than the facility list, for the purpose of facility control, the exceeding bytes of the 
TERMINAL PROFILE shall be compared according to the generic rules found in TS 3 1 . 1 1 1 [ 1 2] . 

4.2.94 EFnasconfig (Non Access Stratum Configuration) 

If service n°96 is "available", this file shall be present. This EF contains NAS configuration parameters defined in 
TS 24.368 [65]. The parameters in EF NAS config shall take precedence over the corresponding parameters stored in the 
ME's non-volatile memory. 



Identifier: '6FE8' 


Structure: transparent 


Optional 


File size: Z bytes 


Update activity: low 


Access Conditions: 








READ 


PIN 






UPDATE 


ADM 






ACTIVATE 


ADM 







DEACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toZ 


NAS configuration parameter TLV objects 


M 


Z bytes 



NAS configuration parameter information 



Description 



Value 



M/O/C Length (bytes) 
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nao signalling pnoniy lag 


oU 




H 
\ 


Length 


1 H 

LI 




NOIG \ 


NAS signalling priority value 




L/ 


1 H 

LI 


NMO I Behaviour Tag 


'Q 1 ' 
o\ 


r\ 
\J 


H 
\ 


Lengm 


I O 




NOIG 1 


niviu i oenaviour vaiue 






I O 

L*i 


AHioh >n/ith IIVACI Tin 

Anacn wun nvioi i ag 


'QO' 
OiL 


r\ 
\J 


H 
1 


Length 


I Q 

Lo 




NOIG 1 


Anacn wun nvioi vaiue 






1 Q 

Lo 


Minimum Periodic Search Timer Tag 


IQQ' 
OO 




1 


Length 


I A 
l_4 




Mr\+/-i "1 

NOIG \ 


Minimum Periodic Search Timer value 






I /l 
L4 


Extended access barring Tag 


'Q/1 1 

84 


U 


1 


Length 


1 £ 
LO 




NOIG \ 


Extended access barring value 




c 


L5 


Timer T3245 Behaviour Tag 


•oc 
OO 


u 




Length 


1 c 

Lb 




NotG 1 


Timer T3245 Behaviour value 






1 c 

Lb 


Override NAS signalling low priority Tag 


86 


u 


1 


Length 


L7 


c 


NOIG 1 


Override NAS signalling low priority 
value 




c 


1 7 

L/ 


Override Extended access barring Tag 


'87' 





1 


Length 


L8 


c 


Note 1 


Override Extended access barring value 




c 


L8 


Note 1 : The length is coded according to ISO/IEC 8825-1 [35] 




Note 2: C; if the Tag is present, this is mandatory. 







NAS signalling priority 
Contents: 

As described in TS 24.368 [65], used to determine the NAS signalling priority included in NAS messages. 
Coding: 

As defined for the NAS_SignallingPriority leaf in TS 24.368 [65]. 



NMO I Behaviour 
Content: 

As described in TS 24.368 [65], indicates whether the "NMO I, Network Mode of Operation I" indication is 
applied by the UE. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



bl value to be interpreted as defined for the 
NMO_I_Behaviour leaf in TS 24.368 [65] . 

"RFU (see TS 31 . 101 [11] ) 



Attach with IMSI 
Content: 

As described in TS 24.368 [65], indicates whether attach with IMSI is performed when moving to a non- 
equivalent PLMN. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



bl value to be interpreted as defined for the 
AttachWithlMSI leaf in TS 24.368 [65]. 

"RFU (see TS 31 . 101 [11] ) 



- Minimum Periodic Search Timer 
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Content: 

As described in TS 24.368 [65], gives a minimum value in minutes for the timer T controlling the periodic 
search for higher prioritized PLMNs. The content applies a minimum value that may override the value in file 
EFjjpplmn (Higher Priority PLMN search period), as specified in TS 23.122 [31] clause 4.4.3.3.1. 
Coding: 

As defined for the MinimumPeriodicSearchTimer leaf in TS 24.368 [65]. 



Extended access barring 
Content: 

As described in TS 24.368 [65], indicates whether the UE applies extended access barring. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



bl value to be interpreted as defined for 
ExtendedAccessBarring leaf in TS 24.368 [65]. 

"RFU (see TS 31 . 101 [11] ) 



Timer T3245 Behaviour 
Content: 

As described in TS 24.368 [65], indicates whether the timer T3245 and the related functionality is used by the 
UE. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



bl value to be interpreted as defined for 
Timer_T324 5_Behaviour leaf in TS 24.368 [65]. 

"RFU (see TS 31 . 101 [11] ) 



Override NAS signalling low priority 
Contents: 

As described in TS 24.368 [65], used to determine whether the NAS signalling priority included in NAS 
messages can be overriden. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



bl value to be interpreted as defined for the 
Override_NAS_SignallingLowPriority leaf in 
TS 24 .368 [65] . 

"RFU (see TS 31 . 101 [11] ) 



Override Extended access barring 
Contents: 

As described in TS 24.368 [65], used to determine whether the Extended access barring included in NAS 
messages can be overriden. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



bl value to be interpreted as defined for the 
Override_ ExtendedAccessBarring leaf in 
TS 24 .368 [65] . 

"RFU (see TS 31 . 101 [11] ) 



Unused bytes shall be set to EF. 

4.2.95 EFuicciari (UICC IARI) 

If service n°95 is "available", this file shall be present. 

As specified in TS 24.229 [63] a ME includes the list of IARIs for the IMS applications it intends to use when sending 
an initial registration or when sending subsequent registrations to the IMS in the form of a SIP REGISTER request. 
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This EF contains a list of IARIs associated with active applications installed on the UICC that are included in the SIP 
REGISTER request in accordance with the procedures of TS 24.229 [63]. 

NOTE: If this file is present in both the USIM and the ISIM, the file in the ISIM is used. It is assumed that the 
presence of this file in the USIM when an ISIM is present on the UICC is an incorrect configuration of 
the UICC. 



Identifier: '6FE7 I 


Structure: 


linear fixed 




Optional 


Record length: X bytes. 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
ACTIVATE 
DEACTIVATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 toX 


IARI TLV object 


M 


X bytes 



IARI TLV object: 
Contents: 

The content and coding is defined below. 



Coding of the IARI TLV objects 



Length 


Description 


Value 


Status 


1 byte 


IARI TLV TAG 


'80' 


M 


1 byte 


Length of IARI 


Y 


M 


Y bytes 


IARI value 




M 



- Coding: 

IMS Application Reference Identifier: shall be coded as specified in TS 24.229 [63]. 
Unused bytes shall be set to 'FF'. 



4.3 DFs at the USIM ADF (Application DF) Level 

DFs may be present as child directories of USIM ADF. The following DFs are defined: 



DFpHONEBOOK 


'5F3A' (see Note 2). 


DF GSM _ ACCESS 


'5F3B'. 


DF M exE 


'5F3C. 


DF WLAN 


'5F40'. 


DFhnb 


'5F50' 


DFsoLSA 


'5F70' 


DF BCASX 


'5F80' (see Note 1). 


Note 1: The DF identifier '5F80' is reserved for OMA BCAST Smart Card Profile [49] 


Note 2: DF for application specific phonebook. This DF has the same structure as the DF PHONEBOOK under 



DF TELE coM- 
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4.4 Contents of DFs at the USIM ADF (Application DF) level 
4.4. 1 Contents of files at the DF SoLSA level 

This only applies if the Support of Localised Service Areas is supported, as indicated by Service Number 23 in the 
USIM Service Table and specified in TS 23.073 [23] . 

The Efs contain information about the users subscribed local service areas. 

4.4.1 .1 EFsai (SoLSA Access Indicator) 

This EF contains the 'LS A only access indicator'. This EF shall always be allocated if DF So lsa is present. 

If the indicator is set, the network will prevent terminated and/or originated calls when the MS is camped in cells that 
are not included in the list of allowed LSAs in EF SLL . Emergency calls are, however, always allowed. 

The EF also contains a text string which may be displayed when the MS is out of the served area(s). 



Identifier: '4F30' 


Structure: transparent 


Optional 


File size: X + 1 bytes 


Update activity: low 



Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


LSA only access indicator 


M 


1 byte 


2 to X+1 


LSA only access indication text 


M 


X bytes 



- LSA only access indicator 
Contents: indicates whether the MS is restricted to use LSA cells only or not. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



bl=0: LSA only access not activated 
bl=l: LSA only access activated 

"rfu 



- LSA only access indication text 

Contents: text to be displayed by the ME when it's out of LSA area. 

Coding: the string shall use either 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set to 0. The alpha identifier 
shall be left justified. Unused bytes shall be set to FF'; or 



4.4.1.2 



one of the UCS2 coded options as defined in the annex of TS 31.101 [11]. 

EF SL L (SoLSA LSA List) 



This EF contains information describing the LSAs that the user is subscribed to. This EF shall always be allocated if 
DF SoLSA is present. 

Each LSA is described by one record that is linked to a LSA Descriptor file. Each record contains information of the 
PLMN, priority of the LSA, information about the subscription and may also contain a text string and/or an icon that 
identifies the LSA to the user. The text string can be edited by the user. 
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Identifier: '4F31' 


Structure: linear fixed 


Optional 


Record length: X + 1 bytes 


Update activity: low 



Access Conditions: 



READ PIN 

UPDATE PIN 

INVALIDATE ADM 

REHABILITATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


LSA name 


O 


X bytes 


X+1 


Configuration parameters 


M 


1 byte 


X+2 


RFU 


M 


1 byte 


X+3 


Icon Identifier 


M 


1 byte 


X+4 


Priority 


M 


1 byte 


X+5 to X+7 


PLMN code 


M 


3 bytes 


X+8 to X+9 


LSA Descriptor File Identifier 


M 


2 byte 


X+10 


LSA Descriptor Record Identifier 


M 


1 byte 



LSA name 

Contents: LSA name string to be displayed when the ME is camped in the corresponding area, dependant on the 
contents of the LSA indication for idle mode field. 

Coding: the string shall use either 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set to 0. The alpha identifier 
shall be left justified. Unused bytes shall be set to 'FF'; or 

- one of theUCS2 code options defined in the annex of TS 31.101 [11]. 
- Configuration parameters 

Contents: Icon qualifier, control of idle mode support and control of LSA indication for idle mode. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


















Icon qualifier 

Idle mode support 

LSA indication for idle mode 

RFU 



Icon qualifier: 

Contents: The icon qualifier indicates to the ME how the icon is to be used. 

B2, bl : 00: icon is not to be used and may not be present 

01: icon is self-explanatory, i.e. if displayed, it replaces the LSA name 

10: icon is not self-explanatory, i.e. if displayed, it shall be displayed together with the LSA name 
11: RFU 

Idle mode support: 

Contents: The idle mode support is used to indicate whether the ME shall favour camping on the LSA cells in 
idle mode. 

B3 = 0: Idle mode support disabled 
b3 = 1 : Idle mode support enabled 

LSA indication for idle mode: 

Contents: The LSA indication for idle mode is used to indicate whether or not the ME shall display the LSA 
name when the ME is camped on a cell within the LSA. 
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B4 = 0: LSA indication for idle mode disabled 
b4 = 1 : LSA indication for idle mode enabled 

Bits b5 to b8 are RFU (see subclause 9.3). 

Icon Identifier 

Contents: The icon identifier addresses a record in EF IMG . 
Coding: binary. 
Priority 

Contents: Priority of the LSA which gives the ME the preference of this LSA relative to the other LSAs. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 















Priority 
RFU 



'0' is lowest priority, 'F' is highest. 

- PLMN code 

Contents: MCC + MNC for the LSA. 

Coding: according to TS 24.008 [9] and EF LOC i. 

- LSA Descriptor File Identifier: 

Contents: these bytes identify the EF which contains the LSA Descriptors forming the LSA. 

Coding: byte X+8: high byte of the LSA Descriptor file; 
byte X+9: low byte of the LSA Descriptor file. 

- LSA Descriptor Record Identifier: 

Contents: this byte identifies the number of the first record in the LSA Descriptor file forming the LSA. 
Coding: binary. 
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4.4.1.3 



LSA Descriptor files 



Residing under DF SoLSA , there may be several LSA Descriptor files. These Efs contains one or more records again 
containing LSA Descriptors forming the LS As. LS As can be described in four different ways. As a list of LSA Ids, as a 
list of LAC + Cis, as a list of Cis or as a list of LACs. As the basic elements (LSA ID, LAC + CI, CI and LAC) of the 
four types of lists are of different length, they can not be mixed within one record. Different records may contain 
different kinds of lists within the Efs. Examples of codings of LSA Descriptor files can be found in annex F. 



Identifier: '4FXX' 


Structure: linear fixed 


Optional 


Record length: n*X+2 bytes 


Update activity: low 



Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


LSA descriptor type and number 


M 


1 byte 


2 to X+1 


1 st LSA Descriptor 


M 


X bytes 


X+2 to 2X+1 


2™ LSA Descriptor 


M 


X bytes 










(n-1)*X+2 to 
n*X+1 


n m LSA Descriptor 


M 


X bytes 


n*X+2 


Record Identifier 


M 


1 byte 



LSA descriptor type and number: 



Contents: The LSA descriptor type gives the format of the LSA descriptor and the number of valid LSA 
Descriptors within the record. 



Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



















LSA descriptor type 
Number of LSA Descriptors 



LSA descriptor type: 

Contents: Gives the format of the LSA Descriptors. 

B2,bl: 00: LSA ID. 

01: LAC + CI 
10: CI 
11: LAC 

Number of LSA Descriptors: 

Contents: Gives the number of valid LSA Descriptors in the record. 

Coding: binary, with b8 as MSB and b3 as LSB leaving room for 64 LSA Descriptors per record. 

- LSA Descriptor 
Contents: Dependant of the coding indicated in the LSA descriptor type: 

- in case of LSA ID the field length 'X' is 3 bytes; 

- in case of LAC + CI the field length 'X' is 4 bytes; 
in case of CI the field length 'X' is 2 bytes; 

- in case of LAC the field length 'X' is 2 bytes. 
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Coding: according to TS 24.008 [9]. 
- Record Identifier: 

Contents: This byte identifies the number of the next record containing the LSA Descriptors forming the LSA. 
Coding: record number of next record. 'FF' identifies the end of the chain. 
This file utilises the concept of chaining as for EF EX ti. 

The identifier '4FXX' shall be different from one LSA Descriptor file to the other and different from the identifiers of 
EF SAI and EF SLL . For the range of 'XX', see TS 31.101 [11]. 



The Efs in the DF PH onebook level contain phone book related features as required in TS 2 1 . 1 1 1 [ 1 ] . 

The UICC may contain a global phonebook, or application specific phonebooks, or both in parallel. When both 
phonebook types co-exist, they are independent and no data is shared. In this case, it shall be possible for the user to 
select which phonebook the user would like to access. To achieve this, the terminal shall support the global and the 
application specific phonebooks. 

It is recommended that the terminal searches for the global phonebook located under DF TELECO m as its presence is not 
indicated anywhere in the USIM application. 

The global phonebook is located in DF PHO nebook under DF TELECOM . Each specific USIM application phonebook is 
located in DF PHONEBOOK of its respective Application ADF USIM . The organisation of files in DF PHO nebook under ADF USIM 
and under DF telecom follows the same rules. Yet DF PHONEBOOK under ADF USM may contain a different set of files than 
DFphonebook under DF TELECO m- All phonebook related Efs are located under their respective DF PHONEBOOK . USIM 
specific phonebooks are dedicated to application specific entries. Each application specific phonebook is protected by 
the application PIN. 

EF ADN and EF PB r shall always be present if the DFphonebook is present. If any phonebook file other than EFadn or 
EF EX ti, is used, then EF PBC shall be present. 

If a GSM application resides on the UICC, the Efs ADN and EXT1 from one DF PH onebook (defined at GSM application 
installation) are mapped to DF TELEC0M . Their file Ids are specified in TS 51.011 [18], i.e. EF ADN = '6F3A' and EF EX ti = 
'6F4A', respectively. 

If the UICC is inserted into a terminal accessing the ADN and EXT1 files under DF TELECOM ; and a record in these files 
has been updated, a flag in the corresponding entry control information in the EF PBC is set from to 1 by the UICC. If 
the UICC is later inserted into a terminal that supports the global and/or application specific phonebook, the terminal 
shall check the flag in EF PBC and if this flag is set, shall update the EF CC , and then reset the flag. A flag set in EF PBC 
results in a full synchronisation of the phonebook between an external entity and the UICC (if synchronisation is 
requested). 

The EF structure related to the public phonebook is located under DF PHONEBOOK in DF TELECOM . A USIM specific 
phonebook may exist for application specific entries. The application specific phonebook is protected by the application 
PIN. The organisation of files in the application specific phonebook follows the same rules as the one specified for the 
public phone book under DF TELECOM . The application specific phonebook may contain a different set of files than the 
one in the public area under DF TELEC0M . 



This file describes the structure of the phonebook. All Efs representing the phonebook are specified here (with the 
exception of EF PSC , EF PUID and EF CC ), together with their file identifiers (FID) and their short file identifiers (SFI), if 
applicable. 

Certain kinds of Efs can occur more than once in the phonebook, e.g. there may be two entities of Abbreviated Dialling 
Numbers, EF ADN and EF ADN1 . For these kinds of Efs, no fixed FID values are specified. Instead, the value 4FXX' 
indicates that the value is to be assigned by the card issuer. These assigned values are then indicated in the associated 
TLV object in EF PBR . 



4.4.2 



Contents of files at the DF PHONEBOOK level 



4.4.2.1 



EFpbr (Phone Book Reference file) 
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The SFI value assigned to an EF which is indicated in EF PBR shall correspond to the SFI indicated in the TLV object in 
EF PBR . 

The reference file is a file that contains information how the information in the different files is to be combined together 
to form a phone book entry. The reference file contains records. Each record specifies the structure of up to 254 entries 
in the phone book. Each phone book entry consists of data stored in files indicated in the reference file record. The entry 
structure shall be the same over all the records in the EF pbr. If more than 254 entries are to be stored, a second record 
is needed in the reference file. The structure of a phone book entry is defined by different TLV objects that are stored in 
a reference file record. The reference file record structure describes the way a record in a file that is part of the 
phonebook is used to create a complete entry. Three different types of file linking exist. 

Type 1 files: Files that contain as many records as the reference/master file (EF ADN , EF ADN1 ) and are linked on 
record number bases (Reel -> Reel). The master file record number is the reference. 

Type 2 files: Files that contain less entries than the master file and are linked via pointers in the index 
administration file (EF IAP ). 

Type 3 files: Files that are linked by a record identifier within a record. 



Table 4.1 : Phone Book Reference file Constructed Tags 



Tag Value 


Constructed TAG Description 


■A8' 


Indicating files where the amount of records equal to 
master EF, type 1 


■A9' 


Indicating files that are linked using the index 
administration file, type 2. Order of pointer appearance 
in index administration EF is the same as the order of 
file Ids following this tag 


■AA' 


Indicating files that are linked using a record identifier, 
type 3. (The file pointed to is defined by the TLV 
object.) 



The first file ID in the first record of EF PB r indicated using constructed Tag 'A8' is called the master EF. Access 
conditions for all other files in the Phonebook structure using Tags 'A8', 'A9' or 'AA' is set to the same as for the master 
EF unless otherwise specified in the present document. 

File Ids indicated using constructed Tag 'A8' is a type 1 file and contains the same number of records as the first file that 
is indicated in the data part of this TLV object. All files following this Tag are mapped one to one using the record 
numbers/Ids of the first file indicated in this TLV object. 

File Ids indicated using constructed Tag 'A9' are mapped to the master EF (the file ID indicated as the first data object 
in the TLV object using Tag 'A8') using the pointers in the index administration file. The order of the pointers in the 
index administration file is the same as the order of the file Ids presented after Tag 'A9'. If this Tag is not present in the 
reference file record the index administration file is not present in the structure. In case the index administration file is 
not present in the structure it is not indicated in the data following tag 'A8'. 

File Ids indicated using constructed Tag 'AA' indicate files that are part of the reference structure but they are addressed 
using record identifiers within a record in one or more of the files that are part of the reference structure. The length of 
the tag indicates whether the file to be addressed resides in the same directory or if a path to the file is provided in the 
TLV object. 

Type 2 and type 3 files contain records that may be shared between several phonebook entries (except when otherwise 
indicated). The terminal shall ensure that a shared record is emptied when the last phonebook entry referencing it is 
modified in such a way that it doesn't reference the record anymore. 

NOTE: in the current version of the specification, only type 3 files contain records that may be shared. 

Each constructed Tag contains a list of primitive Tags indicating the order and the kind of data (e.g. ADN, IAP,...) of 
the reference structure. 

The primitive tag identifies clearly the type of data, its value field indicates the file identifier and, if applicable, the SFI 
value of the specified EF. That is, the length value of a primitive tag indicates if an SFI value is available for the EF or 
not: 

- Length = '02' Value: 'FID (2 bytes)' 
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- Length = '03' Value: 'FID (2 bytes)', 'SFI (1 byte)' 



Table 4.2: Tag definitions for the phone book kind of file 



Tag Value 


TAG Description 


CO 


EFadn data object 




triApuata uuject 


'C2' 


EFexti data object 


'C3' 


EFsNEdata object 


'C4' 


EF A NP.data object 


'C5' 


EFpbc data object 


'C6' 


EFgrp data object 


'C7' 


EF A Asdata object 


'C8' 


EF G Asdata object 


'C9' 


EFuid data object 


'CA' 


EF E MWLdata object 


'CB' 


EFccpi data object 



Table 4.3 (below) lists the allowed types for each kind of file: 



Table 4.3: Presence of files as type 



File name 


Type 1 


Type 2 


Type 3 


EFaas 






X 


EFadn 


X 






EFanr 


X 


X 




EFemail 


X 


X 




EFexti 






X 


EFgas 






X 


EFgrp 


X 






EFiap 


X 






EFpbc 


X 






EFsne 


X 


X 




EFuid 


X 






EFccpi 






X 



Phone Book Reference file EF PBR structure 



Identifier: '4F30' 


Structure: linear fixed 




Conditional 










(see Note) 


Record Length: X bytes | Update activity: low 


Access Conditions: 








READ 




PIN 






UPDATE 




ADM 






DEACTIVATE 


ADM 






ACTIVATE 


ADM 






Bytes 


Description 


M/O 


Length 


1 toX 


TLV object(s) for indicating Efs that are part of 


M 


X bytes 




the phone book structure 






NOTE: This file is mandatory if and only if DF P h nebook is present. 



At the end of each record, unused bytes, if any, shall be filled with 'FF'. 

4.4.2.2 EFiap (Index Administration Phone book) 

This file is present if Tag 'A9' is indicated in the reference file. 

The EF contains pointers to the different records in the files that are part of the phone book. The index administration 
file record number/ID is mapped one to one with the corresponding EF ADN (shall be record to record). The index 
administration file contains the same amount of records as EF ADN . The order of the pointers in an EF IAP shall be the 
same as the order of file Ids that appear in the TLV object indicated by Tag 'A9' in the reference file record. The amount 
of bytes in a record is equal to the number of files indicated the EF PBR following tag 'A9'. 
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The value 'FF' is an invalid record number/ID and is used in any location in to indicate that no corresponding record in 
the indicated file is available. 

The content of EF IAP is set to 'FF' at the personalisation stage. 

Index administration file EF !A p structure 



Identifier: '4FXX' 



SFI: 'YY' 



Structure: linear fixed 



Conditional 
(see Note) 



Record Length: X bytes, (X > 1 ) 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


Record number of the first object indicated after 
Tag 'A9' 


M 


1 byte 


2 


Record number of the second object indicated 
after Tag 'A9' 


C 


1 byte 


X 


Record number of the x tn object indicated after 
Tag 'A9' 


C 


1 byte 



NOTE 1 : This file is mandatory if and only if type 2 files are present, 
-field marked w 
present in EF PB r 



NOTE 2: x th -field marked with "C" is mandatory if x th -object indicated following tag "A9" is 



4.4.2.3 



EFadn (Abbreviated dialling numbers) 



This EF contains Abbreviated Dialling Numbers (ADN) and/or Supplementary Service Control strings (SSC). In 
addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records. It may also 
contain an associated alpha-tagging. 



Identifier: '4FXX' 


Structure: linear fixed 


Conditional 
(see Note) 


SFI: 'YY' 





Record length: X+14 bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


O 


X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3 to X+1 2 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration 1 Record Identifier 


M 


1 byte 


X+14 


Extensionl Record Identifier 


M 


1 byte 



NOTE: This file is mandatory if and only if DFphqnebook is present. 



- Alpha Identifier. 
Contents: 

- Alpha-tagging of the associated dialling number. 
Coding: 

- this alpha-tagging shall use either: 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set to 0. The alpha identifier 
shall be left justified. Unused bytes shall be set to FF'. 

Or: 

- one of the UCS2 coded options as defined in the annex of TS 31.101 [11]. 
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NOTE 1 : The value of X may be from zero to 241 . Using the command GET RESPONSE the ME can determine 
the value of X. 

- Length of BCD number/SSC contents. 
Contents: 

this byte gives the number of bytes of the following two data items containing actual BCD number/SSC information. 
This means that the maximum value is 11, even when the actual ADN/SSC information length is greater than 11. When 
an ADN/SSC has extension, it is indicated by the extensionl identifier being unequal to 'FF'. The remainder is stored in 
the EF EX ti with the remaining length of the additional data being coded in the appropriate additional record itself (see 
clause 4.4.2.4). 

Coding: 

- according to TS 24.008 [9]. 

- TON and NPI. 
Contents: 

- Type of number (TON) and numbering plan identification (NPI). 
Coding: 

- according to TS 24.008 [9]. If the Dialling Number/SSC String does not contain a dialling number, e.g. a control 
string deactivating a service, the TON/NPI byte shall be set to 'FF' by the ME (see note 2). 

NOTE 2: If a dialling number is absent, no TON/NPI byte is transmitted over the radio interface (see 

TS 24.008 [9]). Accordingly, the ME should not interpret the value 'FF' and not send it over the radio 
interface. 



B8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














NPI 
TON 




1 



- Dialling Number/SSC String 
Contents: 

- up to 20 digits of the telephone number and/or SSC information. 
Coding: 

- according to TS 24.008 [9], TS 22.030 [4] and the extended BCD-coding (see table 4.4). If the telephone number or 
SSC is longer than 20 digits, the first 20 digits are stored in this data item and the remainder is stored in an associated 
record in the EF EX ti- The record is identified by the Extensionl Record Identifier. If ADN/SSC require less than 

20 digits, excess nibbles at the end of the data item shall be set to F'. Where individual dialled numbers, in one or more 
records, of less than 20 digits share a common appended digit string the first digits are stored in this data item and the 
common digits stored in an associated record in the EF EX ti. The record is identified by the Extension 1 Record 
Identifier. Excess nibbles at the end of the data item shall be set to F'. 

Byte X+3 



B8 


b7 


B6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 1 



MSB of Digit 1 
LSB of Digit 2 



MSB of Digit 2 



Byte X+4: 
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B8 


b7 


B6 


b5 


b4 


b3 


b2 


bl 



LSB of Digit 3 



MSB of Digit 3 
LSB of Digit 4 



MSB of Digit 4 



etc. 

- Capability/Configuration 1 Record Identifier. 
Contents: 

- capability/configuration identification byte. This byte identifies the number of a record in the EF CCP i containing 
associated capability/configuration parameters required for the call. The use of this byte is optional. If it is not used it 
shall be set to 'FF. 

Coding: 

- binary. 

Extension 1 Record Identifier. 
Contents: 

extensionl record identification byte. This byte identifies the number of a record in the EF EX ti containing an 
associated called party subaddress or additional data. The use of this byte is optional. If it is not used it shall be set to 
FF. 

- if the ADN/SSC requires both additional data and called party subaddress, this byte identifies the additional record. 
A chaining mechanism inside EF EX ti identifies the record of the appropriate called party subaddress (see clause 4.4.2.4). 

Coding: 

- binary. 

NOTE 3: EF ADN in the public phone book under DF TELECO m mav be used by USIM, GSM and also other 

applications in a multi-application card. If the non-GSM application does not recognise the use of Type of 
Number (TON) and Number Plan Identification (NPI), then the information relating to the national 
dialling plan shall be held within the data item dialling number/SSC and the TON and NPI fields set to 
UNKNOWN. This format would be acceptable for 3G operation and also for the non-GSM application 
where the TON and NPI fields shall be ignored. 

EXAMPLE: SIM storage of an International Number using E.164 [22] numbering plan. 

TON NPI Digit field. 
USIM application 001 0001 abc... 

Other application compatible with 3G 000 0000 xxx...abc... 

where "abc..." denotes the subscriber number digits (including its country code), and "xxx..." 
denotes escape digits or a national prefix replacing TON and NPI. 

NOTE 4: When the ME acts upon the EF ADN with a SEARCH RECORD command in order to identify a character 
string in the alpha-identifier, it is the responsibility of the ME to ensure that the number of characters used 
as SEARCH RECORD parameters are less than or equal to the value of X if the MMI allows the user to 
offer a greater number. 
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Table 4.4: Extended BCD coding 



BCD Value 


Character/Meaning 


'0' 


"0" 






'9' 


"9" 


'A' 




'B' 


"#" 


'C 


DTMF Control digit separator (see TS 22.101 [24]). 


'D' 


"Wild" value. This will cause the MMI to prompt the user for a single digit (see TS 22.101 [24]). 


'E 


RFU. 


F 


Endmark e.g. in case of an odd number of digits. 



BCD values 'C, 'D' and 'E' are never sent across the radio interface. 

NOTE 5: The interpretation of values 'D', 'E' and 'F' as DTMF digits is for further study. 

NOTE 6: A second or subsequent C BCD value will be interpreted as a 3 second PAUSE (see TS 22.101 [24]). 



4.4.2.4 EF E xti (Extension - !) 

This EF contains extension data of an ADN/SSC. 

Extension data is caused by: 

an ADN/SSC which is greater than the 20 digit capacity of the ADN/SSC Elementary File or where common 
digits are required to follow an ADN/SSC string of less than 20 digits. The remainder is stored in this EF as a 
record, which is identified by a specified identification byte inside the ADN/SSC Elementary File. The EXT1 
record in this case is specified as additional data; 

- an associated called party subaddress. The EXT1 record in this case is specified as subaddress data. 



Identifier: '4FXX' 



Structure: linear fixed 



Optional 



SFI: 'YY' 



Record length: 13 bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


1 1 bytes 


13 


Identifier 


M 


1 byte 



- Record type. 
Contents: 

- type of the record. 
Coding: 



B8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Called Party Subaddress 
Additional data 

"rfu 



b3 to b8 are reserved and set to 0; 

a bit set to 1 identifies the type of record; 

only one type can be set; 

'00' indicates the type "unknown" or "free". 
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The following example of coding means that the type of extension data is "additional data": 



B8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


I 




I 




I 




I 




I 




I 




I 

1 


1 





- Extension data. 
Contents: 

additional data or Called Party Subaddress depending on record type. 
Coding: 

Case 1, Extensionl record is additional data: 

- The first byte of the extension data gives the number of bytes of the remainder of ADN/SSC. The coding 
of remaining bytes is BCD, according to the coding of ADN/SSC. Unused nibbles at the end shall be set 
to 'F. It is possible if the number of additional digits exceeds the capacity of the additional record to chain 
another record inside the EXT1 Elementary File by the identifier in byte 13. In this case byte 2 (first byte 
of the extension data) of all records for additional data within the same chain indicates the number of 
bytes ('01' to 'OA') for ADN/SSC (respectively MSISDN, LND) within the same record unequal to 'FF'. 

Case 2, Extensionl record is Called Party Subaddress: 

- The subaddress data contains information as defined for this purpose in TS 24.008 [9]. All information 
defined in TS 24.008, except the information element identifier, shall be stored in the USIM. The length 
of this subaddress data can be up to 22 bytes. In those cases where two extension records are needed, 
these records are chained by the identifier field. The extension record containing the first part of the 
called party subaddress points to the record which contains the second part of the subaddress. 

- Identifier. 
Contents: 

identifier of the next extension record to enable storage of information longer than 1 1 bytes. 
Coding: 

record number of next record. 'FF' identifies the end of the chain. 

- Example of a chain of extension records being associated to an ADN/SSC. The extensionl record identifier 
(Byte 14+X) of EF ADN is set to 3. 



Record 1 



Record 2 



• Record 3 



Record 4 



Record 5 



Record 6 



EF EXT1 


Byte: 1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


13 


Record 
Type 


Extension data 


Identifier 




01 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


FF 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


02 


OA 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


04 


02 


04 


XX 


XX 


XX 


XX 


FF 


FF 


FF 


FF 


FF 


FF 


06 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


01 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


XX 


01 



1 

3 



In this example, ADN/SSC is associated to additional data (records 3 and 4) which represent the last 27 or 28 digits of 
the whole ADN/SSC (the first 20 digits are stored in EF ADN ) and a called party subaddress whose length is more than 11 
bytes (records 6 and 1). 

4.4.2.5 EFrbc (Phone Book Control) 

This EF contains control information related to each entry in the phone book. This EF contains as many records as the 
EF ADN associated with it (shall be record to record). Each record in EF PBC points to a record in its EF ADN . This file 
indicates the control information and the hidden information of each phone book entry. 
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The content of EF PBC is linked to the associated EF ADN record by means of the ADN record number/ID (there is a one to 
one mapping of record number/identifiers between EF PBC and EF ADN ). 



Structure of control file EF PB c 



Identifier: '4FXX' 


Structure: linear fixed 


Conditional 








(see Note) 


SFI: 'YY' 




Record length: 2 bytes 


Update activity: low 


Access Conditions: 








READ 


PIN 






UPDATE 


PIN 






DEACTIVATE 


ADM 






ACTIVATE 


ADM 







Bytes 


Description 


M/O 


Length 


1 


Entry Control Information 


M 


1 byte 


2 


Hidden Information 


M 


1 byte 



NOTE: This file is mandatory if one or both of the following is true: 

- hidden entries are supported 
- a GSM SIM application is supported in the UICC. 



Entry Control Information. 
Contents: 

- provides some characteristics about the phone book entry e.g. modification by a terminal accessing the ADN and 
EXT1 files under DF TELECO m ( see clause 4.4.2). 

Coding: 



b8 


B7 


b6 


B5 


b4 


B3 


b2 


Bl 





















Modified phonebook entry 
RFU (see TS 31.101) 



no change 1 1 



Hidden Information. 
Contents: 

indicates to which USIM application of the UICC this phone book entry belongs, so that the corresponding secret code 
can be verified to display the phone book entry. If the secret code is not verified, then the phone book entry is hidden. 

Coding: 

'00' - the phone book entry is not hidden; 

'xx' - the phone book entry is hidden, 'xx' is the record number in EF DIR of the associated USIM application. 



4.4.2.6 EFqrp (Grouping file) 

This EF contains the grouping information for each phone book entry. This file contains as many records as the 
associated EF ADN . Each record contains a list of group identifiers, where each identifier can reference a group to which 
the entry belongs. 
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Structure of grouping file EF GRP 



Identifier: '4FXX' 



SFI: 'YY' 



Structure: linear fixed 



Conditional 
(see Note) 



Record Length: X bytes (1 < X <10) 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


Group Name Identifier 1 


M 


1 byte 


2 


Group Name Identifier 2 


O 


1 byte 


X 


Group Name Identifier X 


O 


1 byte 



NOTE: This file is mandatory if and only if EFqas is present. 



- Group Name Identifier x. 
Content: 

- indicates if the associated entry is part of a group, in that case it contains the record number of the group name in 
EF GAS . 

- One entry can be assigned to a maximum of 10 groups. 
Coding: 

- '00' - no group indicated; 

'XX' - record number in EF GAS containing the alpha string naming the group of which the phone book entry is a 
member. 



4.4.2.7 



EFaas (Additional number Alpha String) 



This file contains the alpha strings that are associated with the user defined naming tags for additional numbers 
referenced in EF ANR . 

Structure of EF AAS 



Identifier: '4FXX' 


Structure: linear fixed j Optional 


SFI: Optional 




Record length: X bytes 


Update activity: low 


Access Conditions: 






READ 


PIN 




UPDATE 


PIN 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 



1 toX 



Alpha text string 



Description 



M/O 



M 



Length 



X bytes 



- Alpha text string. 
Content: 

- user defined text for additional number. 
Coding: 

- same as the alpha identifier in EF ADN . 
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4.4.2.8 EFqas (Grouping information Alpha String) 

This file contains the alpha strings that are associated with the group name referenced in EF GRP . 

Structure of EF G as 



Identifier: '4FXX' 



SFI: Optional 



Structure: linear fixed 



Conditional 
(see Note) 



Record length: X bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Alpha text string 


M 


X bytes 


NOTE: This file is mandatory if and only if EFqrp is present. 



- Alpha text string 

Content: 

- group names. 

Coding: 

- same as the alpha identifier in EF ADN . 



4.4.2.9 



EFanr (Additional Number) 



Several phone numbers and/or Supplementary Service Control strings (SSC) can be attached to one EF ADN record, using 
one or several EF ANR . The amount of additional number entries may be less than or equal to the amount of records in 
EF ADN . The EF structure is linear fixed. Each record contains an additional phone number or Supplementary Service 
Control strings (SSC). This record cannot be shared between several phonebook entries. The first byte indicates whether 
the record is free or the type of additional number referring to the record number in EF AAS , containing the text to be 
displayed. The following part indicates the additional number and the reference to the associated record in the EF ADN 
file. In addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records. 

Structure of EF A nr 



Identifier: '4FXX' 


Structure: linear fixed ! Optional 


SFI: 'YY' 




Record length: 15 or 17 bytes 


; Update activity: low 


Access Conditions: 






READ 




PIN 


UPDATE 




PIN 


DEACTIVATE 




ADM 


ACTIVATE 




ADM 



Bytes 


Description 


M/O 


Length 


1 


Additional Number Record identifier 


M 


1 byte 


2 


Length of BCD number/SSC contents 


M 


1 byte 


3 


TON and NPI 


M 


1 byte 


4 to 13 


Additional number/SSC String 


M 


1 bytes 


14 


Capability/Configuration 1 Record Identifier 


M 


1 byte 


15 


Extensionl Record Identifier 


M 


1 byte 


16 


ADN file SFI 


C 


1 byte 


17 


ADN file Record Identifier 


C 


1 byte 



NOTE: The fields marked C above are mandatory if and only if the file is not type 1 
specified in EF PB r) 



,as 



Additional Number Record Identifier 
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Content: 

describes the type of the additional number defined in the file EF AAS . 
Coding: 

- '00' - no additional number description; 

'xx' - record number in EF AAS describing the type of number (e.g. "FAX"); 
'FF' - free record. 

- Length of BCD number/SSC contents 
Contents: 

this byte gives the number of bytes of the following two data items containing actual BCD number/SSC information. 
This means that the maximum value is 11, even when the actual additional number/SSC information length is greater 
than 11. When the additional number/SSC has extension, it is indicated by the extensionl identifier being unequal to 
'FF'. The remainder is stored in the EF EX ti with the remaining length of the additional data being coded in the 
appropriate additional record itself (see clause 4.4.2.4). 

Coding: 

- same as the length of BCD number/SSC string byte in EF ADN 

- TON and NPI. 
Contents: 

- Type of number (TON) and numbering plan identification (NPI). 
Coding: 

same as the TON and NPI byte in EF ADN 

- Additional number/SSC string 
Content: 

- up to 20 digits of the additional phone number and/or SSC information linked to the phone book entry. 
Coding: 

- same as the dialling number /SSC string in EF^n 

- Capability/Configuration 1 Record Identifier. 
Contents: 

- This byte identifies the number of a record in the EF CCP1 containing associated capability/configuration parameters 
required for the call. The use of this byte is optional. If it is not used it shall be set to FF'. 

Coding: 

- binary. 

Extensionl Record Identifier. 
Contents: 

- extensionl record identification byte. This byte identifies the number of a record in the EF EX ti containing an 
associated called party subaddress or additional data. The use of this byte is optional. If it is not used it shall be set to 
FF. 

if the number requires both additional data and called party subaddress, this byte identifies the additional record. A 
chaining mechanism inside EF EX ti identifies the record of the appropriate called party subaddress (see clause 4.4.2.4). 

Coding: 

- binary. 

- ADN file SFI. 
Content: 

- Short File identifier of the associated EF ADN file. 
Coding: 

- as defined in the UICC specification. 
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- ADN file Record Identifier 
Content: 

- record identifier of the associated phone book entry. 
Coding: 

'xx' - record identifier of the corresponding ADN record. 

4.4.2.1 EFsne (Second Name Entry) 

The phone book also contains the option of a second name entry. The amount of second name entries may be less than 
or equal to the amount of records in EF ADN . Each record contains a second name entry. This record cannot be shared 
between several phonebook entries. 

Structure of EF S ne 



Identifier: '4FXX' 


Structure: linear fixed \ Optional 


SFI: 'YY' 




Record length: X or X+2 bytes 


| Update activity: low 


Access Conditions: 






READ 




PIN 


UPDATE 




PIN 


DEACTIVATE 




ADM 


ACTIVATE 




ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier of Second Name 


M 


X bytes 


X+1 


ADN file SFI 


C 


1 byte 


X+2 


ADN file Record Identifier 


C 


1 byte 



NOTE: The fields marked C above are mandatory if and only if the file is not type 1 (as 
specified in EF PB r) 



- Alpha Identifier of Second Name. 
Content: 

string defining the second name of the phone book entry. 
Coding: 

as the alpha identifier for EF ADN . 

- ADN file SFI. 
Content: 

- Short File identifier of the associated EF ADN file. 
Coding: 

- as defined in the UICC specification. 

- ADN file Record Identifier 
Content: 

record identifier of the associated phone book entry. 
Coding: 

'xx' - record identifier of the corresponding ADN record. 



4.4.2.11 



EFccpi (Capability Configuration Parameters 1) 



This EF contains parameters of required network and bearer capabilities and ME configurations associated with a call 
established using a phone book entry. 
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Structure of EF C cpi 



Identifier: '4FXX' 


Structure: linear fixed | Optional 


SFI: 'YY' 




Record length: X bytes, X > 15 


Update activity: low 



Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Bearer capability information element 


M 


X bytes 



Bearer capability information element. 
Contents and Coding: 

- see TS 24.008 [9]. The Information Element Identity (IEI) shall be excluded; i.e. the first byte of the EF CCP1 record 
shall be Length of the bearer capability contents. 

"- unused bytes are filled with 'FF' 



4.4.2.12 Phone Book Synchronisation 

To support synchronisation of phone book data with other devices, the USIM may provide the following files to be used 
by the synchronisation method: a phone book synchronisation counter (PSC), a unique identifier (UID) and change 
counter (CC) to indicate recent changes. 

If synchronisation is supported in the phonebook, then EF PSC , EF UID , EF PUID and EF CC are all mandatory. 



4.4.2.12.1 EFuid (Unique Identifier) 

The EF UID is used to uniquely identify a record and to be able to keep track of the entry in the phone book. The terminal 
assigns the (UID) when a new entry is created. The value of the UID does not change as long as the value of the PBID 
remains the same. The UID shall remain on the UICC, in EFuid, until the PBID is regenerated. This means that when a 
phone book entry is deleted, the content of the linked information (e.g. ADN, E-MAIL,..) shall be set to the 
personalization value 'FF. . .FF'. But the UID-value of the deleted record shall not be used when a new entry is added to 
the phonebook until the PBID is regenerated, but it shall be set to a new value. 

If/when the PBID is regenerated, all UIDs for the entry in the phone book shall be assigned new values starting from 1. 
If more than one EF UID exists (i.e. multiple phone book file sets) then all values of UIDs used in that phone book shall 
be unique over all phone book file sets within that phone book. The new value of the UID for each entry shall then be 
kept until the PBID is regenerated again. 



Structure of EFuid 



Identifier: '4FXX' 


Structure: linear fixed 


Conditional 
(see Note) 


SFI: 'YY' 




Record length: 2 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 







Bytes 


Description 


M/O 


Length 


1 to 2 


Unique Identifier (UID) of Phone Book Entry 


M 


2 bytes 


NOTE: This file is mandatory if and only if synchronisation is supported in the phonebook. 



Unique Identifier of Phone Book Entry. 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



117 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Content: 

number to unambiguously identify the phone book entry for synchronisation purposes. 
Coding: 

- hexadecimal value. At initialisation all UIDs are personalised to "00 00" (i.e. empty). 



4.4.2.12.2 



EFpsc (Phone book Synchronisation Counter) 



The phone book synchronisation counter (PSC) is used by the ME to construct the phone book identifier (PBID) and to 
determine whether the accessed phone book is the same as the previously accessed phone book or if it is a new 
unknown phone book (might be the case that there is one phonebook under DF-telecom and one phone book residing in 
a USIM-application). If the PSC is unknown, a full synchronisation of the phone book will follow. 

The PSC is also used to regenerate the UIDs and reset the CC to prevent them from running out of range. When the 
UIDs or the CC has reached its maximum value, a new PSC is generated. This leads to a scenario where neither the CC 
nor the UIDs will run out of range. 

The PSC shall be regenerated by the terminal if one of the following situation applies: 
the values of the UIDs have run out of range; 

- the whole phone book has been reset/deleted; 

- the value of the CC has run out of range. 

Structure of EF PS c 



Identifier: '4F22' 



SFI: 'YY' 



Structure: transparent 



Conditional 
(see Note) 



File size: 4 bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 to 4 


Phone book synchronisation counter (PSC) 


M 


4 bytes 


NOTE: This file is mandatory if and only if synchronisation is supported in the phonebook. 



PSC: Unique synchronisation counter of Phone Book. 
Content: 

number to unambiguously identify the status of the phone book for synchronisation purposes. 
Coding: 

hexadecimal value. 

The phone book identifier (PBID) coding based on the EF PSC is described hereafter: 
For a phone book residing in DF-telecom: 

- PBID = ICCid (lObytes) "fixed part" + 4 bytes (in EF PSC ) "variable part". 
- For a phone book residing in an USIM application: 

- PBID = 10 last bytes of (ICCid XOR AID) "fixed part" + 4 bytes (in EF PS c) "variable part". 

To be able to detect if the PSC needs to be regenerated (i.e. the variable part) the following test shall be made by 
the terminal before for each update of either the CC or the assignment of a new UID: 

- Each time the terminal has to increment the value of the UID the following test is needed: 

- IfUID = 'FFFF'then. 

{Increment PSC mod EF FF FF FF; all the UIDs shall be regenerated}. 
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- Each time the terminal has to increment the value of CC the following test is needed: 
IfCC = 'FFFF'then. 

{ Increment PSC mod FF FF FF FF'; CC=000 1 } . 
NOTE: If the phonebook is deleted then the terminal will change the PSC according to: 
Incrementing PSC modulus FFFFFFFF'. 

4.4.2.1 2.3 EFcc (Change Counter) 

The change counter (CC) shall be used to detect changes made to the phone book. 

Every update/deletion of an existing phone book entry or the addition of a new phone book entry causes the terminal to 
increment the EF CC . The concept of having a CC makes it possible to update the phone book in different terminals, 
which still are able to detect the changes (e.g. changes between different handset and/or 2 nd and 3 rd generation of 
terminals). 



Structure of EF CC 



Identifier: '4F23' 


Structure: transparent 


Conditional 
(see Note) 


SFI: 'YY 




File size: 2 bytes 


J Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 






Bytes 


Description 


M/O 


Length 


1 to 2 


Change Counter (CC) of Phone Book 


M 


2 bytes 


NOTE: This file is mandatory if and only if synchronisation 


s supported 


n the phonebook. 



- Change Counter of Phone Book. 
Content: 

- indicates recent change(s) to phone book entries for synchronisation purposes. 
Coding: 

- hexadecimal value. At initialisation, CC shall be personalised to '00 00' (i.e. empty). 

4.4.2.12.4 EFruid (Previous Unique Identifier) 

The PUID is used to store the previously used unique identifier (UID). The purpose of this file is to allow the terminal 
to quickly generate a new UID, which shall then be stored in the EF UID . 
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Structure of EF PU id 



Identifier: '4F24' 


Structure: transparent 


Conditional 
(see Note) 


SFI: 'YY' 




File size: 2 bytes 


Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 to 2 


Previous Unique Identifier (PUID) of Phone 
Book Entry 


M 


2 bytes 


NOTE: This file is mandatory if and only if synchronisation is supported 


n the phonebook. 



- Previous unique Identifier of Phone Book Entry. 
Content: 

- Previous number that was used to unambiguously identify the phone book entry for synchronisation purposes. 
Coding: 

- As for EF UID 

4.4.2.13 EFemail (e-mail address) 

This EF contains the e-mail addresses that may be linked to a phone book entry. Several e-mail addresses can be 
attached to one EFADN recor d, using one or several EFemail- The number of email addresses may be equal to or less 
than the amount of records in EFadn- Each record contains an e-mail address. The first part indicates the e-mail 
address, and the second part indicates the reference to the associated record in the EFadn file- This record cannot be 
shared between several phonebook entries. 



Structure of EFemail 



Identifier: '4FXX' | 


Structure: linear fixed Optional 


SFI: 'YY' 




Record length: X or X+2 bytes 


Update activity: low 


Access Conditions: 






READ 


PIN 




UPDATE 


PIN 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes Description M/O Length 

1 to X E-mail Address M X bytes 



X+1 ADN file SFI C 1 byte 

X+2 |ADN file Record Identifier | C | 1 byte 
NOTE: The fields marked C above are mandatory if and only if the file is not type 1 (as 
specified in EF PB r) 

- E-mail Address. 
Content: 

- string defining the e-mail address 
Coding: 

- the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set to 0. The alpha identifier shall be left 
justified. Unused bytes shall be set to FF'. 
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- ADN file SFI. 
Content: 

- short File identifier of the associated EF ADN file. 
Coding: 

- as defined in TS 31.101. 

- ADN file Record Identifier. 
Content: 

- record identifier of the associated phone book entry. 

Coding: 

- binary. 

4.4.2.14 Phonebook restrictions 

This clause lists some general restrictions that apply to the phonebook: 

if an EFpbr file contains more than one record, then they shall all be formatted identically on a type-by-type 
basis, e.g. if EF PB r record #1 contains one type 1 e-mail then all EF PB r records shall have one type 1 email; 

if an EFp BR record contains more than one reference to one kind of file, such as two EF EMAIL files, then they 
shall all be formatted identically on a type-by-type basis, e.g. if an EF PBR record has 2 email addresses, then 
they shall have the same record size and the same number of records in each EF PBR entry; 

an EF PB r record may contain TLV entries indicating that the file exist as a type 1 and 2 file, e.g. a phonebook 
entry may have two emails, one with a one-to-one mapping (type 1) and one with a indirect mapping (type 2). 
Regardless of the type, files in all entries shall have the same record configuration; 

- an EF PBR record shall not contain more than one occurrence of a given kind of file indicated in tag 'AA' (type 3 
link). For instance, an EF PBR record may only contain one reference to an EF EX ti- 

4.4.3 Contents of files at the DF GSM-ACCESS level 
(Files required for GSM Access) 

The Efs described in this clause are required for the USIM application to be able to access service through a GSM 
network. 

The presence of this DF and thus the support of a GSM access is indicated in the 'USIM Service Table' as service no. 
'27' being available. 

4.4.3.1 EF Kc (GSM Ciphering key Kc) 

If service n°27 is "available", this file shall be present. 

This EF contains the ciphering key Kc and the ciphering key sequence number n for enciphering in a GSM access 
network. 



Identifier: '4F20' 


Structure: transparent 


Optional 


SFI: '01' 




File size: 9 bytes 


Update activity: high 


Access Conditions: 










READ 




PIN 








UPDATE 


PIN 








DEACTIVATE 


ADM 








ACTIVATE 


ADM 








Bytes 


Description 


M/O 


Length 


1 to 8 


Ciphering key Kc 


M 


8 bytes 


9 


Ciphering key sequence number n 


M 


1 byte 
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Ciphering key Kc. 
Coding: 

the least significant bit of Kc is the least significant bit of the eighth byte. The most significant bit of Kc is the most 
significant bit of the first byte. 



Ciphering key sequence number n 



Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

















N 

bits b4 to b8 are coded 



NOTE: TS 24.008 [9] defines the value of n=l 1 1 as "key not available". Therefore the value '07' and not 'FF 
should be present following the administrative phase. 

4.4.3.2 EFkcgprs (GPRS Ciphering key KcGPRS) 

If service n°27 is "available", this file shall be present. 

This EF contains the ciphering key KcGPRS and the ciphering key sequence number n for GPRS (see TS 23.060 [7]). 



Identifier: '4F52' | 


Structure: transparent Optional 


SFI: '02 




File size: 9 bytes 


Update activity: high 


Access Conditions: 






READ 


PIN 




UPDATE 


PIN 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 



1 to 8 



Ciphering key KcGPRS 



Description 



Ciphering key sequence number n for GPRS 



M/O 



M 



M 



Length 



8 bytes 



1 byte 



- Ciphering key KcGPRS. 
Coding: 

the least significant bit of KcGPRS is the least significant bit of the eighth byte. The most significant bit of KcGPRS 
is the most significant bit of the first byte. 

- Ciphering key sequence number n for GPRS. 

Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

















bits b4 to b8 are coded 



NOTE: TS 24.008 [9] defines the value of n=l 1 1 as "key not available". Therefore the value '07' and not FF' 
should be present following the administrative phase. 



4.4.3.3 



Void 



4.4.3.4 EFcpbcch (CPBCCH Information) 

If service n°39 is "available", this file shall be present. 

This EF contains information concerning the CPBCCH according to TS 44.018 [28]. 

CPBCCH storage may reduce the extent of a Mobile Station's search of CPBCCH carriers when selecting a cell. The 
CPBCCH carrier lists shall be in accordance with the procedures specified TS 23.022 [29]. The MS stores CPBCCH 
information (from the System Information 19 message, Packet System Information 3, and Packet System Information 3 
bis) on the USIM. The same CPBCCH carrier shall never occur twice in the list. 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



122 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Identifier: '4F63' 



Structure: transparent 



Optional 



File size: 2n bytes 



Update activity: high 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 to 2 


Element 1 of CPBCCH carrier list 


M 


2 bytes 










2n-1 to 2n 


Element n of CPBCCH carrier list 


M 


2 bytes 



- Element in CPBCCH carrier list 
Coding: 

Byte 1: first byte of CPBCCH carrier list element 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



LSB of ARFCN 



Byte 2: second byte of CPBCCH carrier list element 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



MSB of ARFCN 
High/Low band indicator 
bits b4 to b7 are RFU 
Empty indicator 



- ARFCN ( 1 bits) as defined in TS 45 .005 [34] . 

- High/Low band indicator: If the ARFCN indicates possibly a channel in the DCS 1800 or a channel in the 
PCS 1900 band, if the bit is set to T' the channel is in the higher band (GSM 1900). If the bit is set to '0', 
the lower band (GSM 1800) is indicated. If ARFCN indicates a unique channel, this indicator shall be set 
to '0'. 

- Empty indicator: If this bit is set to '1', no valid CPBCCH carrier is stored in this position. If the Empty 
Indicator is set to '1', the content of the CPBCCH carrier field shall be ignored. The empty indicator shall 
also be used, and set to T, if storage of fewer than maximum number n, of CPBCCH carrier fields is 
required. 

4.4.3.5 EFinvScan (Investigation Scan) 

If service n°40 is "available", this file shall be present. 

This EF contains two flags used to control the investigation scan for higher prioritized PLMNs not offering voice 
services. 
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Identifier: '4F64' 



File size: 1 byte 



Structure: transparent 



Update activity: low 



Optional 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


Investigation scan flags 


M 


1 byte 



Investigation scan flags 



Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



In limited service mode 

After successful PLMN selection 

Bits b3 to b8 are coded RFU 



A '1' in a bit position indicates that the investigation scan shall be performed for the condition 
corresponding to that bit position and a '0' that it shall not be performed. 

If this elementary file is not present, no investigation scan shall be performed. 

4.4.4 Contents of files at the MexE level 

This clause specifies the Efs in the dedicated file DF MexE . It only applies if the USIM supports MexE (see 
TS 23.057 [30]). 

The presence of this DF is indicated in the 'USIM Service Table' as service no. '41' being available. 
The Efs in the Dedicated File DF MexE contain execution environment related information. 

4.4.4.1 EF M exE-sT (MexE Service table) 

If service n°41 is "available", this file shall be present. 

This EF indicates which MexE services are available. If a service is not indicated as available in the USIM, the ME 
shall not select this service. 



Identifier: '4F40' 


Structure: transparent | Optional 


File size: X bytes, X > 1 


Update activity: low 


Access Conditions: 






READ 


PIN 




UPDATE 


ADM 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 


Description 


M/O 


Length 


1 


Services n°1 to n°8 


M 


1 byte 


2 


Services n°9 to n°16 


O 


1 byte 


etc. 








X 


Services (8X-7) to (8X) 


O 


1 byte 



-Services 
Contents: 



Service n°l 
Service n°2 
Service n°3 
Service n°4 



Operator Root Public Key 
Administrator Root Public Key 
Third Party Root Public Key 
RFU 
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Coding: 

the coding rules of the USIM Service Table apply to this table. 



4.4.4.2 EForpk (Operator Root Public Key) 

If service n°41 is "available", this file shall be present. 

This EF contains the descriptor(s) of certificates containing the Operator Root Public Key. This EF shall only be 
allocated if the operator wishes to verify applications and certificates in the MexE operator domain using a root public 
key held in the USIM. Each record of this EF contains one certificate descriptor. 

For example, an operator may provide a second key for recover disaster procedure in order to limit OTA data to load. 



Identifier: '4F41 ' j Structure: linear fixed 




Optional 


Record length: X + 10 bytes 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 


Parameters indicator 


M 


1 byte 


2 


Flags 


M 


1 byte 


3 


Type of certificate 


M 


1 byte 


4 to 5 


Key/certificate file identifier 


M 


2 bytes 


6 to 7 


Offset into key/certificate file 


M 


2 bytes 


8 to 9 


Length of key/certificate data 


M 


2 bytes 


10 


Key identifier length (X) 


M 


1 byte 


1 1 to 1 0+X 


Key identifier 


M 


X bytes 



- Parameter indicator 
Contents: 

The parameter indicator indicates if record is full and which optional parameters are present 
Coding: bit string 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Certificate descriptor is valid (bitl=0 key 
descriptor is valid) 

Reserved bit set to 1 (bitx=0 optional parameter 
present) 



- Flags 
Contents: 

The authority flag indicates whether the certificate identify an authority (i.e. CA or AA) or not. 
Coding: bit string 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Authority certificate (bit=l certificate of an 
authority) 

"rfu 
"rfu 



- Type of certificate 
Contents: 

This field indicates the type of certificate containing the key. 

Coding: binary: 
:WTLS 
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1 : X509 

2 :X9.68 

Other values are reserved for further use 

- Key/certificate File Identifier 
Contents: 

these bytes identify an EF which is the key/certificate data file (see clause 4.4.4.5), holding the actual key/certificate 
data for this record. 

Coding: 

byte 4: high byte of Key/certificate File Identifier; 
byte 5: low byte of Key/certificate File Identifier. 

- Offset into Key/certificate File 
Contents: 

these bytes specify an offset into the transparent key/certificate data File identified in bytes 4 and 5. 
Coding: 

byte 6: high byte of offset into Key/certificate Data File; 
byte 7: low byte of offset into Key/certificate Data File 

- Length of Key/certificate Data 
Contents: 

these bytes yield the length of the key/certificate data, starting at the offset identified in "Offset into Key/certificate 
File" field. 

Coding: 

byte 8: high byte of Key/certificate Data length; 
byte 9: low byte of Key/certificate Data length. 

Key identifier length 

Contents: 

This field gives length of key identifier 

Coding: 
binary 

- Key identifier 
Contents: 

This field provides a means of identifying certificates that contain a particular public key (chain building) and linking 
the public key to its corresponding private key. For more information about value and using see TS 23.057 [30]. 

Coding: 
octet string 

NOTE: transparent key/certificate data longer than 256 bytes may be read using successive READ BINARY 
commands. 

4.4.4.3 EFarpk (Administrator Root Public Key) 

If service n°41 is "available", this file shall be present. 

This EF contains the descriptor(s) of certificates containing the Administrator Root Public Key. This EF shall only be 
allocated if the SIM issuer wishes to control the Third Party certificates on the terminal using an Administrator root 
public key held in the USIM. Each record of this EF contents one certificate descriptor. 
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This file shall contain only one record. 



Identifier: '4F42' Structure: linear fixed 




Optional 


Record length: X + 10 bytes 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/O 


Length 


1 


Parameters indicator 


M 


1 byte 


2 


Flags 


M 


1 byte 


3 


Type of certificate 


M 


1 byte 


4 to 5 


Key/certificate file identifier 


M 


2 bytes 


6 to 7 


Offset into key/certificate file 


M 


2 bytes 


8 to 9 


Length of key/certificate data 


M 


2 bytes 


10 


Key identifier length (X) 


M 


1 byte 


1 1 to 1 0+X 


Key identifier 


M 


X bytes 



For contents and coding of all data items see the respective data items of the EF rpk (clause 4.4.4.2). 

4.4.4.4 EFjprpk (Third Party Root Public Key) 

If service n°41 is "available", this file shall be present. 

This EF contains descriptor(s) of certificates containing the Third Party root public key (s). This EF shall only be 
allocated if the USIM issuer wishes to verify applications and certificates in the MexE Third Party domain using root 
public key(s) held in the USIM. This EF can contain one or more root public keys. Each record of this EF contains one 
certificate descriptor. 

For example, an operator may provide several Third Party Root Public Keys. 



ldentifier:'4F43' 



Structure: linear fixed 



Optional 



Record length: X + Y + 1 1 bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


Parameters indicator 


M 


1 byte 


2 


Flags 


M 


1 byte 


3 


Type of certificate 


M 


1 byte 


4 to 5 


Key/certificate file identifier 


M 


2 bytes 


6 to 7 


Offset into key/certificate file 


M 


2 bytes 


8 to 9 


Length of key/certificate data 


M 


2 bytes 


10 


Key identifier length (X) 


M 


1 byte 


11 to 10+X 


Key identifier 


M 


X bytes 


11+X 


Certificate identifier length (Y) 


M 


1 byte 


12+X to 
1 1 +X+Y 


Certificate identifier 


M 


Y bytes 



- Certificate identifier length 
Contents: 

This field gives the length of the certificate identifier 

Coding: 
binary 
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- Certificate identifier 
Contents: 

This field identifies the issuer and provides an easy way to find a certificate. For more information about the value and 
usage see TS 23.057 [30]. 

Coding: 
Octet string 

For contents and coding of all other data items see the respective data items of the EF rpk (clause 4.4.4.2). 

4.4.4.5 EFjkcdf (Trusted Key/Certificates Data Files) 

Residing under DF Mcx e, there may be several key/certificates data files. These Efs containing key/certificates data shall 
have the following attributes: 



Identifier: '4FXX' | 


Structure: transparent i Optional 


File size: Y bytes 


Update activity: low 


Access Conditions: 






READ 


PIN 




UPDATE 


ADM 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes 


Description 


M/O 


Length 


1 to Y 


Key/Certificate Data 


M 


Y bytes 



Contents and coding: 

Key/certificate data are accessed using the key/certificates descriptors provided by EF TPRPK (see clause 4.4.4.4). 

The identifier 4FXX' shall be different from one key/certificate data file to another. For the range of 'XX', see 
TS 31.101 [11]. The length Y may be different from one key/certificate data file to another. 



4.4.5 Contents of files at the DF WLAN level 

This clause describes the additional files that are used for WLAN purposes. 

DF WLAN shall be present at the ADF US im level if either of the services n°59, n°60, n°61, n°62, n°63, n°66, n°81, n°82, 
n°83, n°84 or n°88 are "available" in the corresponding EF UST (USIM Service Table). 



4.4.5.1 EFpseudo (Pseudonym) 

If service n°59 is "available", this file shall be present. 

This EF contains a temporary user identifier (pseudonym) for subscriber identification. Pseudonyms may be provided as 
part of a previous authentication sequence. Pseudonyms are used as defined in TS 24.234 [40]. 



Identifier: '4F41' 


Structure: Transparent 


Optional 


SFI : '01' 




File size: Y bytes (Y>n+2) 


Update activity: high 


Access Conditions: 










READ 




PIN 








UPDATE 


PIN 








DEACTIVATE 


ADM 








ACTIVATE 


ADM 








Bytes 


Description 


M/O 


Length 


1 to 2 


Pseudonym Length 


M 


2 bytes 


3 to n+2 


Pseudonym 


M 


n bytes 



-Pseudonym Length 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



128 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Contents: 

- this byte gives the number of bytes of the following data item containing the Pseudonym value. 
Coding: 

- unsigned length coded on 2 bytes 

- Pseudonym. 

Contents: 

-Pseudonym to be used as the username part of the NAI 
Coding: 

- As described for the user portion of the NAI in TS 33.234 [41]. Unused bytes shall be set to 'FF' and shall 
not be considered as a part of the value. 

4.4.5.2 EFuplmnwlan (User controlled PLMN selector for l-WLAN Access) 

If service n°60 is "available", this file shall be present. 

This EF contains the coding for preferred PLMNs to be used for WLAN PLMN Selection. This information is 
determined by the user and defines the preferred PLMNs of the user in priority order. The first PLMN entry indicates 
the highest priority and the n th PLMN entry indicates the lowest. It shall be possible to store at least the number of 
PLMNs specified in TS 24.234 [40]. 



Identifier: 4F42' [ Structure: transparent |Optional 


SFI: '02' 




File size: 3n (where n >10) 


Update activity: low 



Access Conditions: 



READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


1 st PLMN (highest priority) 


M 


3 bytes 


4 to 6 


2™ PLMN 


M 


3 bytes 










28 to 30 


10 tn PLMN 


M 


3 bytes 


31 to 33 


11 ln PLMN 


O 


3 bytes 










(3n-2) to 3n 


N tn PLMN (lowest priority) 


O 


3 bytes 



- PLMN 
Contents: 

- Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

- according to TS 24.008 [9]. 

4.4.5.3 EFqplmnwlan (Operator controlled PLMN selector for l-WLAN 
Access) 

If service n°61 is "available", this file shall be present. 

This EF contains the coding for operator preferred PLMNs to be used for WLAN PLMN Selection. This information is 
determined by the operator and defines the operator preferred PLMNs in priority order. The first PLMN entry indicates 
the highest priority and the n th PLMN entry indicates the lowest. It shall be possible to store at least the number of 
PLMNs specified in TS 24.234 [40]. 
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Identifier: '4F43' ' Structure: transparent |Optional 


SFI: '03' 




File size: 3n (where n >10) 


Update activity: low 



Access Conditions: 

READ PIN 

UPDATE ADM 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 to 3 


1 st PLMN (highest priority) 


M 


3 bytes 


4 to 6 


2™ PLMN 


M 


3 bytes 










28 to 30 


10 m PLMN 


M 


3 bytes 


31 to 33 


11 tn PLMN 


O 


3 bytes 










(3n-2) to 3n 


N m PLMN (lowest priority) 


O 


3 bytes 



- PLMN 
Contents: 

- Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

- according to TS 24.008 [9]. 



4.4.5.4 EFuwsidl (User controlled WLAN Specific Identifier List) 

If service n°62 is "available", this file shall be present. 

This file contains the user preferred list of WLAN specific identifier (WSID) for WLAN selection in priority order. The 
first record indicates the highest priority and the n th record indicates the lowest. This file is used for WLAN selection 
and shall store a list of at least the number of WSIDs specified in TS 24.234 [40]. 



Identifier: '4F44' j 


Structure: linear fixed 




Optional 


SFI: '04' 




Record size: X+1 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 

ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Length of WSID 


M 


1 bytes 


2 to X + 1 


WSID 


M 


X bytes 



-Length of WSID 
Contents: 

- this byte gives the number of bytes of the following data item containing the WSID. 
Coding: 

- unsigned length coded on one byte 

-WSID 
Contents: 

- WLAN specific identifier (WSID) as defined in TS 24.234 [40] . 
Coding: 

- binary. Unused bytes shall be set to 'FF' and not used either as a part of the value or for length calculation. 
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4.4.5.5 EFowsidl (Operator controlled WLAN Specific IdentifierList) 

If service n°63 is "available", this file shall be present. 

This file contains the operator preferred list of WLAN specific identifier (WSID) for WLAN selection in priority order. 
The first record indicates the highest priority and the n th record indicates the lowest. This file is used for WLAN 
selection It shall be possible to store at least the number of PLMNs specified in TS 24.234 [40]. 



Identifier: 4F45' 


Structure: linear fixed 


Optional 


SFI: '05' 




Record size: X + 1 bytes 


Update activity: low 


Access Conditions: 












READ 






PIN 








UPDATE 




ADM 








DEACTIVATE 




ADM 








ACTIVATE 




ADM 








Bytes 


Description 


M/O 


Length 


1 


Length of WSID 


M 


1 bytes 


2 to X + 1 


WSID 


M 


X bytes 



-Length of WSID 
Contents: 

- this byte gives the number of bytes of the following data item containing the WSID. 
Coding: 

- unsigned length coded on one byte 

-WSID 
Contents: 

- WLAN specific identifier (WSID) as defined in TS 24.234 [40] . 
Coding: 

- binary. Unused bytes shall be set to 'FF' and not used either as a part of the value or for length calculation. 

4.4.5.6 EFwri (WLAN Reauthentication Identity) 

If service n°66 is "available", this file shall be present. 

This EF contains a list of parameters linked to a re-authentication identity to be used in fast re-authentication. Re- 
authentication identities and related parameters (Master Key and Counter Value) are provided as part of a previous 
authentication sequence. 
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Identifier: '4F46' | Structure: Transparent Optional 


SFI: '06' 




File size: n bytes, (n > J+K+L+6) 


Update activity: high 



Access Conditions: 

READ PIN 

UPDATE PIN 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 


Reauthentication Identity Tag '80' 


M 


1 byte 


2 


Re-authentication Identity Length 


M 


1 byte 


3 to J+2 


Re-authentication Identity Value 


M 


J bytes 


J+3 


Master Key Tag '81' 


M 


1 byte 


J+4 


Master Key Length 


M 


1 byte 


J+5 to J+K+4 


Master Key Value 


M 


K bytes 


J+K+5 


Counter Tag '82' 


M 


1 byte 


J+K+6 


Counter Length 


M 


1 byte 


J+K+7 to 
J+K+L+6 


Counter Value 


M 


L bytes 



- Reauthentication Identity 
Contents: 

- Re-authentication identity TLV to be used as the username part of the NAI. 

Coding: 
Tag '80' 

Unsigned length on 1 byte 

Value: As described for the user portion of the NAI in TS 33.234 [41]. Unused bytes shall be set to 'FF' and shall not be 
considered as a part of the value. 

- Master Key 
Contents: 

- Master Key TLV. 

Coding: 
Tag '81' 

Unsigned length on 1 byte 

Value: As described in TS 33.234 [41]. 

- Counter 
Contents: 

- Counter TLV 

Coding: 
Tag '82' 

Unsigned length on 1 byte 
Value: As described in TS 33.234 [41]. 

4.4.5.7 EFhwsidl (Home l-WLAN Specific Identifier List) 

If service n°81 is "available", this file shall be present. 

This file contains the Home I-WLAN specific identifier list (WSID list) for I-WLAN selection in priority order. The 
WSIDs in this list are known to connect to the HPLMN. The first record indicates the highest priority and the n* record 
indicates the lowest. This file is used for I-WLAN selection. It shall be possible to store at least the number of WSIDs 
specified in TS 24.234 [40]. 
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Identifier: '4F47' | 


Structure: linear fixed 




Optional 


SFI: '07' 




Record size: X + 1 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 


Length ofWSID 


M 


1 bytes 


2 to X + 1 


WSID 


M 


X bytes 



For contents and coding see EF wsidl- 

4.4.5.8 EFwehplmnpi (l-WLAN Equivalent HPLMN Presentation Indication) 

If service n°82 is "available", this file shall be present. 

This EF contains an indication to the ME for the presentation of the available EHPLMN(s) during I-WLAN selection 
procedures. The usage of the I-WLAN EHPLMN presentation indication is defined in TS 24.234 [40]. 



Identifier: '4F48' 


Structure: transparent 


Optional 


SFI: '08' 




File size: 1 byte 


Update activity: low 


Access Conditions: 










READ 




PIN 








UPDATE 




ADM 








DEACTIVATE 


ADM 








ACTIVATE 


ADM 








Bytes 


Description 


M/O 


Length 


1 


I-WLAN EHPLMN Presentation Indication 


M 


1 byte 



- I-WLAN EHPLMN Presentation Indication: 
Contents: 

I-WLAN EHPLMN display mode 

Coding: 

- '00' - No preference for the display mode 

- '01' - Display the highest-priority available EHPLMN only 

- '02' - Display all the available EHPLMNs 

- All other values are RFU 

4.4.5.9 EFwhpi (I-WLAN HPLMN Priority Indication) 

If service n°83 is "available", this file shall be present. 

This EF contains an indication to the ME for the selection of the I-WLAN EHPLMN or the I-WLAN last Registered 
PLMN. The usage of the I-WLAN HPLMN Priority Indication file is defined in TS 24.234 [40]. 
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Identifier: '4F49' 



SFI: '09' 



Structure: transparent 



File size: 1 byte 



Optional 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 



1 



Description 



l-WLAN Last RPLMN Selection Indication 



M/O 



M 



Length 



1 byte 



- I-WLAN Last RPLMN Selection Indication: 
Contents: 

I-WLAN Last RPLMN Selection Indication 
Coding: 

- '00' - The UE shall attempt registration on the last I-WLAN RPLMN as described in TS 24.234 [40] 

- '01' - The UE shall attempt registration on the I-WLAN home network as described in TS 24.234 [40] 

- All other values are RFU 

4.4.5.10 EFwlrplmn (I-WLAN Last Registered PLMN) 

If service n°84 is "available", this file shall be present. 

This EF contains I-WLAN Last Registered PLMN Selection. The usage of the I-WLAN Last Registered PLMN is 
defined in TS 24.234 [40]. 



Identifier: '4F4A' 



SFI: 'OA' 



Structure: transparent 



File size: 3 bytes 



Optional 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 

ADM 
ADM 



Bytes 



1 to 3 



Description 



I-WLAN Last Registered PLMN 



M/O 



M 



Length 



3 bytes 



- I-WLAN Last Registered PLMN 
Contents: 

- Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 

Coding: 
- according to TS 24.008 [9]. 

4.4.5.1 1 EFhplmndai (HPLMN Direct Access Indicator) 

If service n°88 is "available", this file shall be present. 

This EF contains HPLMN Direct Access related informations. The usage of the HPLMN Direct Access Indicator file is 
defined in TS 23.234 [40]. 
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Identifier: '4F4B' 


Structure: transparent 


Optional 


SFI: 'OB' 




File size: 1 byte 


Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 


HPLMN Direct Access Indication 


M 


1byte 



- HPLMN Direct Access Indication: 
Contents: 

HPLMN Direct Access Indication 

Coding: 

- '00' - HPLMN Direct Access Indicator is disabled 

- '01' - HPLMN Direct Access Indicator is enabled 
- All other values are RFU 

4.4.6 Contents of files at the DF HNB level 

4.4.6.1 Introduction 

This clause describes the additional files that are used for Home (e)NodeB purposes. 

DF H nb shall be present at the ADF USIM level if service n°86 and/or service n°90 isare "available" in EF UST . 

4.4.6.2 EFacsgl (Allowed CSG Lists) 

If service n°86 is "available", this file shall be present. 

This EF contains the coding for CSG ID belonging to the Allowed CSG lists. Furthermore, for each CSG ID in the list, 
a link to the corresponding HNB name and CSG Type may be provided. 



Identifier: '4F81' 



Structure: linear fixed 



SFI: '01' 



Record length: X 



Optional 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


CSG Lists TLV object 


M 


X bytes 


Note: The CSG List in different records may contain the same PLMN 



The CSG List TLV object shall contain only one PLMN TLV object, Tag '80', and at least one CSG information TLV, 
Tag '81'. A record may contain one or more CSG List TLV objects. This means that all CSG Ids in one CSG List TLV 
object belong to the same PLMN. 



CSG List Tags 



Description 



Tag Value 
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CSG List TLV object Tag 



'AO' 



CSG List information 



Description 


Value 


M/O 


Length (bytes) 


CSG List Tag 


'AO' 


M 


1 


Length 


Y 


M 


Note 


PLMN Tag 


'80' 


M 


1 


Length 


A 


M 


Note 


PLMN 




M 


A 


CSG Information Tag 


'81' 


M j 


1 


Length 


W 


M 


Note 


CSG Information 




M 


W 


Note: The length is coded according to ISO/IEC 8825-1 [35] 



PLMN Tag '80' 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

according to TS 24.008 [47]. 



CSG Information Tag '81' 



Tag '81' Coding: 



1 


CSG Type indication 


M 


1 byte 


2 


HNB Name indication 


M 


1 byte 


3toW 


CSG ID 


M 


W-2 bytes 


Note: The length of the CSG ID is calculated from the TLV object length 



CSG Type indication 
Contents: 

the CSG Type for the subsequent CSG ID. 
Coding: 

a value of '00' indicates that the CSG Type is to be taken from other sources (e.g. broadcasted by the 
Home Node B or stored in the non-volatile memory of the ME). A value in the range '01' to 'FE' 
indicates the record number in EF C sgt that shall be displayed as the CSG Type. 

HNB Name indication 

Contents: 

the HNB name for the subsequent CSG ID. 
Coding: 

a value of '00' indicates that the HNB name is to be taken from other sources (e.g. broadcasted by the 
Home Node B or stored in the non-volatile memory of the ME). A value in the range '01' to 'FE' 
indicates the record number in EF H nbn that shall be displayed as the HNB name. 

CSG ID 

Contents: 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



136 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



CSG ID which is part of the allowed CSG list. 
Coding: 

the CSG ID shall be encoded as defined in TS 23.003 [25]. The CSG ID is coded left justified, i.e. the 
most significant bit of the CSG ID is coded on bit 8 of byte 3, over the number of bits as specified in 
TS 23.003 [25] using bytes 3 to W . The unused rightmost bits of byte W shall be set 1. 



Unused bytes shall be set to 'FF'. 
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4.4.6.3 EFcsgt (CSG Type) 

If service n°86 is "available", this file shall be present. 

This EF contains the CSG Type. The CSG Type is defined in TS 22.220 [54]. The association between a CSG ID and 
the corresponding CSG Type is provided in EF ACSGL . The CSG Type may be provided in text or in graphic format. 



Identifier: '4F82' | 


Structure: linear fixed i Optional 


SFI: '02' 




Record length: X bytes 


Update activity: low 


Access Conditions: 






READ 


PIN 




UPDATE 


PIN 




DEACTIVATE 


ADM 





ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


CSG Type TLV objects 


M 


X bytes 



CSG Type tags 



Description 


Tag Value 


Text CSG Type Tag 


'89' J 


Graphics CSG Type Tag 


'80' or '81' 



CSG Type information 
Contents: 

CSG Type contains either Text CSG Type or Graphic CSG Type or both the Graphic and Text CSG Types 
Coding: 

Text CSG Type: 



Description 


Value 


M/O 


Length (bytes) 


Text CSG Type Tag 


'89' 


M 


1 


Length 


K 


M 


Note 


Text CSG Type 




M 


K 


Note: The length is coded according to ISO/IEC 8825-1 [35]. 



Graphic CSG Type: 



Description 


Value 


M/O 


Length (bytes) 


Graphic CSG Type Tag 


'80' or '81' 


M 


1 


Length 


K+ 1 


M 


Note 1 


Graphic CSG Type Icon Qualifier 




M 


1 


Graphic CSG Type Icon Link 




M 


K (Note 2) 


Note 1 : The length is coded according to ISO/IEC 8825-1 [35]. 




Note 2: The tag value indicates the type and format of the Icon Link that is provided in the 


TLV value field (e.g. Tag '80' indicates that the Icon link is a URI, while Tag '81' 


indicates that the Icon Link is the record number of the corresponding image in 


EFimg). 









- Text CSG Type Tag '89' 
Contents: 

Tag value for the CSG Type in text format. 
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Coding: 

- '89' = the Text CSG Type is coded using one of the UCS2 code options as defined in TS 31.101 [11]. 
Graphic CSG Type Tag 

Contents: 

Tag value for the CSG Type in graphic format with the Icon Qualifier or an Icon Link 
Coding: 

- '80' = the Graphic CSG Type Icon Link is an URI 

- '81' = the Graphic CSG Type Icon Link is a pointer to the record number of the corresponding image in 

- All other values are RFU. 

Graphic CSG Type Icon Qualifier 
Contents: 

The icon qualifier indicates to the ME how the icon shall be used. 
Coding: 

- '01' = icon is self-explanatory, i.e. if displayed, it replaces the corresponding name in text format. 

- '02' = icon is not self-explanatory, i.e. if displayed, it shall be displayed together with the corresponding 

name in text format. 

- All other values are RFU. 

Graphic CSG Type Icon Link 
Contents: 

Link to the icon. This link shall point to a UICC resource. 
Coding: 

- When the Tag value indicates an URI (i.e. Tag = '80') , the Icon Link shall be encoded to an octet string 
according to UTF-8 encoding rules as described in IETF RFC 3629 [48] (e.g. 
http://127.0.0.1:3516/pub/files/csgtvpe.ipg) . 

- When the Tag value indicates that the Icon Link contains the record number of the corresponding image in 
EFhhg (i.e. Tag = '81'), the Icon Link shall be encoded in binary. 

Unused bytes shall be set to 'FF'. 
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4.4.6.4 EFhnbn (Home NodeB Name) 

If service n°86 is "available", this file shall be present. 

This EF contains the HNB name. The HNB name is defined in TS 22.220 [54]. HNB name is a common name referring 
to HNB/HeNB. The association between a CSG ID and the corresponding HNB name is provided in EF ACSGL . 



Identifier: '4F83' 



Structure: linear fixed 



Optional 



SFI: '03' 



Record length: X bytes; X > 3 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
ACTIVATE 
DEACTIVATE 



PIN 
PIN 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


HNB Name TLV object 


M 


X bytes 



HNB Name tags 



Description 


Tag Value 


HNB Name Tag 


'80' 



HNB Name information 



Description 


Value 


M/O 


Length (bytes) 


HNB Name Tag 


'80' 


M 


1 


Length 


K 


M 


Note 


HNB Name 




M 


K 


Note 1 : The length is coded according to ISO/IEC 8825-1 [35]. 



- HNB Name Tag '80' 
Contents: 



name of the HNB or HeNB. 



Coding: 

coded using one of the UCS2 code options as defined in TS 31.101 [11]. 
Unused bytes shall be set to 'FF'. 



4.4.6.5 EFocsgl (Operator CSG Lists) 

If service n°90 is "available", this file shall be present. 

This EF contains the coding for CSG Ids belonging to the Operator CSG lists. Furthermore, for each CSG ID in the list, 
a link to the corresponding HNB name and CSG type may be provided. Within one PLMN the first occurrence of CSG 
ID indicates the highest priority CSG ID and the last occurrence indicates the lowest. 

Note: There is no requirement for the ME to take the priority into account. 

Additionally, if service n°92 is "available", this EF allows the HPLMN to control, on a per PLMN basis, which 
available CSGs are displayed by the ME during a manual CSG selection. If there is no CSG display indicator for a 
PLMN, the ME shall display the available CSGs according to the value in EF AD byte 3 bit 2. 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



140 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Identifier: '4F84' 



Structure: linear fixed 



SFI: '04' 



Record length: Y bytes 



Optional 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



PIN 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Operator CSG List TLV objects 


M 


X bytes 


Note2: The CSG List in different records may contain the same PLMN 



The Operator CSG List TLV object shall contain only one PLMN TLV object, Tag '80', and at least one Operator CSG 
information TLV, Tag '81'. A record may contain one or more Operator CSG List TLV objects. This means that all 
CSG Ids in one Operator CSG List TLV object belong to the same PLMN. 

Additionally, the Operator CSG List TLV object may contain one CSG Display Indicator TLV object, if service n°92 is 
available. 

CSG List Tags 



Description 


Tag Value 


Operator CSG List TLV object Tag 


'AO' 



CSG List information 



Description 


Value 


M/O 


Length (bytes) 


CSG List Tag 


'AO' 


M 


1 


Length 


Y 


M 


Note 


PLMN Tag 


'80' 


M 


1 


Length 


A 


M 


Note 


PLMN 




M j 


A 


CSG Information Tag 


'81' 


M 


1 


Length 


W 


M 


Note 


CSG Information 




M 


W 


CSG Display indicator tag 


'82' 


O 


1 


Length 


Y 


O 


Note 


CSG Display indicator 




O 


Y 


Note: The length is coded according to ISO/IEC 8825-1 [35] 



PLMN Tag '80' 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

according to TS 24.008 [47]. 



- CSG Information Tag '8 1 ' 



Tag '81' Coding: 



1 


CSG Type indication 


M 


1 byte 


2 


HNB Name indication 


M 


1 byte 


3toW 


CSG ID 


M 


W-2 bytes 


Note: The length of the CSG ID is calculated from the TLV object length 



- CSG Type indication 
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Contents: 

the CSG Type for the subsequent CSG ID. 
Coding: 

a value of '00' indicates that the CSG Type is to be taken from other sources (e.g. broadcasted by 
the Home Node B or stored in the non-volatile memory of the ME). A value in the range '01' to 
'FE' indicates the record number in EF C sgt that shall be displayed as the CSG Type. 

HNB Name indication 

Contents: 

the HNB name for the subsequent CSG ID. 
Coding: 

a value of '00' indicates that the HNB name is to be taken from other sources (e.g. broadcasted by 
the Home Node B or stored in the non-volatile memory of the ME). A value in the range '01' to 
EE' indicates the record number in EF HNBN that shall be displayed as the HNB name. 

- CSG ID 

Contents: 

CSG ID which is part of the allowed CSG list. 
Coding: 

the CSG ID shall be encoded as defined in TS 23.003 [25]. The CSG ID is coded left justified, i.e. 
the most significant bit of the CSG ID is coded on bit 8 of byte 3, over the number of bits as 
specified in TS 23.003 [25] using bytes 3 to W. The unused rightmost bits of byte W shall be set 1. 

- CSG display indicator: 
Coding: 

- '00' All available CSG Ids can be displayed during a manual CSG selection 

- '01' Only CSG Ids contained in Operator CSG lists shall be displayed during a manual CSG 
selection 

Unused bytes shall be set to 'FF' 

4.4.6.6 EFocsgt (Operator CSG Type) 

If service n°90 is "available", this file shall be present. 

This EF contains the Operator CSG Types. The CSG Type is defined in TS 22.220 [54]. The association between an 
Operator CSG ID and the corresponding Operator CSG Type is provided in EFocsgl- The Operator CSG Type may be 
provided in text or in graphic format. 



Identifier: '4F85' 


Structure: linear fixed 


Optional 


SFI: '05' 




Record length: X bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 


PIN 

ADM 

ADM 







ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


CSG Type TLV objects 


M 


X bytes 
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For coding see EF CSGT 



4.4.6.7 EFohnbn (Operator Home NodeB Name) 

If service n°90 is "available", this file shall be present. 

This EF contains the Operator HNB names. The HNB name is defined in TS 22.220 [54]. HNB Name is a common 
name referring to HNB/HeNB. The association between an Operator CSG ID and the corresponding Operator HNB 
name is provided in EFqcsgl- 



Identifier: '4F86' | Structure: linear fixed | Optional 



SFI: '06' 




Record length: X bytes; X > 3 


Update activity: low 



Access Conditions: 

READ PIN 

UPDATE ADM 

ACTIVATE ADM 

DEACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


HNB Name TLV object 


M 


X bytes 



For coding see EF H nbn 



4.4.7 Void 



4.5 Contents of Efs at the TELECOM level 

The Efs in the Dedicated File DF TELECO m contain service related information. 

4.5.1 EFadn (Abbreviated dialling numbers) 

In case of a present GSM application on the UICC the first EFadn (i-e. reflected by the first record in EF PB r) of the 
DFphonebook is mapped (with an identifier equal to '6F3A') to DF TELE com to ensure backwards compatibility. 

A 3G ME shall not access this file. The information is accessible for a 3G ME in EF ADN under DF PHO nebook. 



4.5.2 EF EXT i (Extension - !) 

In case of a present GSM application on the UICC the first EF EX ti (i.e. reflected by the first record in EF PBR ) of the 
DFphonebook is mapped (with an identifier equal to '6F4A') to DF TELECO m to ensure backwards compatibility. 

A 3G ME shall not access this file. The information is accessible for a 3G ME in EF EX ti under DF PHO nebook. 



4.5.3 EF ECCP (Extended Capability Configuration Parameter) 

In case of a present GSM application on the UICC the first EF CCP i (i.e. reflected by the first record in EF PBR ) of the 
DF PHONEBOOK is mapped (with an identifier equal to '6F4F') to DF TELECO m to ensure backwards compatibility. There shall 
not be any EF CCP (with a file-id of '6F3D') under DF TELECO m because otherwise a GSM terminal could create 
inconsistencies within the phonebook. 

A 3G ME shall not access this file. The information is accessible for a 3G ME in EF C cpi under DF PH onebook. 

4.5.4 EFsume (SetUpMenu Elements) 

This File is defined in ETSI TS 102 222 [39], and has the file identifier '6F54. 
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4.5.5 EFarr (Access Rule Reference) 

This EF contains the access rules for files located under the DF TELECO m in the UICC. If the security attribute tag '8B' is 
indicated in the FCP it contains a reference to a record in this file. 

Structure of EF ARR at DF Te iecom-level 



Identifier: '6F06' 



Structure: Linear fixed 



Mandatory 



Record length: X bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



ALW 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


Access Rule TLV data objects 


M 


X bytes 



This EF contains one or more records containing access rule information according to the reference to expanded format 
as defined in ISO/IEC 7816-4 [20]. Each record represents an access rule. Unused bytes in the record are set to EF'. 

If the card cannot access EF ARR , any attempt to access a file with access rules indicated in this EF ARR shall not be 
granted. 



4.5.6 EFice dn (In Case of Emergency - Dialling Number) 

This EF contains one or more records containing number formatted ICE information, according to TS 22.101 [24]. 

This file shall be deactivated if the user does not wish the ICE information contained in this file to be available and 
activated if the user wishes the ICE information in this file to be available. 

Structure of EF, CE DN at DF Te iecom-level 



Identifier: '6FE0' 



Structure: Linear fixed 



SFI: Optional 



Record length: X+14 bytes 



Optional 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



Update activity: low 



ALWAYS 
PIN 

PIN or Issuer Specified PIN (see Note) 



Bytes 


Description 


M/O 


Length 


1 toX 


Alpha Identifier 


O 


X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3 to X+1 2 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configurationl Record Identifier 


M 


1 byte 


X+14 


Extensionl Record Identifier 


M 


1 byte 



Note: The Issuer Specified PIN is a PIN with a global key reference (see TS 31 .101 [11]) 
specified by the card Issuer. 



Coding: 



As for EF A 



4.5.7 EFice_ff (In Case of Emergency - Free Format) 

This EF contains one or more records containing free formatted ICE information, according to TS 22.101 [24]. 

This file shall be deactivated if the user does not wish the ICE information contained in this file to be available and 
activated if the user wishes the ICE information in this file to be available. 
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Structure of EF| C e 


ff at DFjeiecom-level 




Identifier 


:'6FE1' ! Structure: Linear fixed 




Optional 


SFI: Optional 




Record length: >=X+Y bytes 


Update activity: low 


Access Conditions: 








READ 


ALWAYS 






UPDATE 


PIN 








DEACTIVATE PIN or Issuer Specified PIN (see Note) 


ACTIVATE PIN or Issuer Specified PIN (see Note) 


Bytes 


Description 


M/O 


Length 


1 toX 


ICE Free Format Label TLV 


M 


X bytes 


X+1 to X+Y 


ICE Free Format Content TLV 


M 


Y bytes 


Note: The Issuer Specified PIN is a PIN with a global key reference (see TS 31 .101 [11]) 


specified by the card Issuer. 









- ICE Free Format Label TLV 

Contents: 

This TLV contains a label that summarises the type of content that is contained in the associated ICE Free 
Format Content TLV (e.g. "medical alert information"). 

Coding: 

ICE Free Format Label TLV is coded as follows: 
Tag value is '80' 

Length is coded according to ISO/IEC 8825-1 [35]. 

Value is as for value part of the text string TLV in 3GPP TS 3 1 . 1 1 1 [ 1 2] . If the length is and there is 
no value part then the terminal shall interpret this as no label is used. 

- ICE Free Format Content TLV 

Contents: 

This TLV contains a ICE Free Format Content (e.g. "Allergy to work"). 
Coding: 

ICE Free Format Content TLV is coded as follows: 
Tag value is '81' 

Length is coded according to ISO/IEC 8825-1 [35]. 

Value is as for value part of the text string TLV in 3GPP TS 3 1 . 1 1 1 [ 1 2] . If the length is and there is 
no value part then the terminal shall interpret this as no label is used. 

Padding: unused bytes in each record shall be set to 'FF'. 

4.5.8 EFr M a (Remote Management Actions) 

This File is defined in ETSI TS 102 222 [39], and has the file identifier '6F53'. 
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4.5.9 EFrsismsc (Public Service Identity of the SM-SC) 

This file shall be present if and only if service n°12 and n°91 are "available". 

This EF contains the Public Service Identity of the SM-SC (either a SIP URI or tel URI) that the ME shall use to submit 
SMS over IP as defined in 24.341 [55]. 



Identifier: '6FE5' 


Structure: linear fixed 


Optional 


File size: X bytes 


Update activity: low 


Access Conditions: 








READ 


PIN 






UPDATE 


PIN 






DEACTIVATE 


ADM 







ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 toX 


URI TLV data object 


M 


X bytes 



- URI 

Contents: 

- SIP URI or tel URI of the Public Service Identity of the SM-SC. 
Coding: 

- For contents and syntax of URI TLV data object values see IETF RFC 3261 [56]. The URI shall be encoded 
to an octet string according to UTF-8 encoding rules as specified in IETF RFC 3629 [57]. The tag value of 
the URI TLV data object shall be '80'. 

4.6 Contents of DFs at the TELECOM level 

DFs may be present as child directories of DF TELEC om- The following DFs have been defined: 

- DF GRAPHICS '5F50'. 

DFpHONEBOOK '5F3A'. 

(DF for public phone book. This DF has the same structure as DF PHONEBOOK under ADF USIM). 
DFmultimedia '5F3B'. 

- DF MM ss '5F3C 

(The contents of DF for MMSS are defined in C.S0074-A [53]. This DF for MMSS is not applicable to 3GPP only 
terminals). 

4.6.1 Contents of files at the DF GRAP hics level 

The Efs in the Dedicated File DF GRAPHICS contain graphical information. 

4.6.1.1 EFimg (Image) 

Each record of this EF identifies instances of one particular graphical image, which graphical image is identified by this 
EF's record number. 

Image instances may differ as to their size, having different resolutions, and the way they are coded, using one of 
several image coding schemes. 

As an example, image k may represent a company logo, of which there are i instances in the UICC, of various 
resolutions and perhaps encoded in several image coding schemes. Then, the i instances of the company's logo are 
described in record k of this EF. 
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Identifier: '4F20' | Structure: linear fixed | Optional 

Record length: 9n+1 or 9n+2 bytes, (n > 1) | Update activity: low 

Access Conditions: 

READ PIN 

UPDATE ADM 

DEACTIVATE ADM 

ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


1 


Number of Actual Image Instances 


M 


1 byte 


2 to 10 


Descriptor of Image Instance 1 


M 


9 bytes 


1 1 to 1 9 


Descriptor of Image Instance 2 


O 


9 bytes 










9(n-1)+2 to 9n+1 


Descriptor of Image Instance n 


O 


9 bytes 


9n + 2 


RFU (see TS 31.101 [11]) 


O 


1 byte 



- Number of Actual Image Instances. 
Contents: 

- this byte gives the number of actual image instances described in the following data items (i.e. unused descriptors 
are not counted). 

Coding: 

- binary. 

- Image Instance Descriptor 
Contents: 

- a description of an image instance. 
Coding: 

- Byte 1 : Image Instance Width 
Contents: 

- this byte specifies the image instance width, expressed in raster image points. 

Coding: 

- binary. 

Byte 2: Image Instance Height. 
Contents: 

- this byte specifies the image instance height, expressed in raster image points. 

Coding: 

- binary. 

Byte 3: Image Coding Scheme. 
Contents: 

- this byte identifies the image coding scheme that has been used in encoding the image instance. 
Coding: 

11'- basic image coding scheme as defined in annex B; 

- '21' - colour image coding scheme as defined in annex B; 

- '22' - colour image coding scheme with transparency as defined in annex B; 
other values are reserved for future use. 

Bytes 4 and 5: Image Instance Data File Identifier. 

Contents: 

- these bytes identify an EF which is the image instance data file (see clause 4.6.1.2), holding the actual image data 
for this particular instance. 
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Coding: 

- byte 4: high byte of Image Instance Data File Identifier; 

- byte 5: low byte of Image Instance Data File Identifier. 

Bytes 6 and 7: Offset into Image Instance Data File. 
Contents: 

these bytes specify an offset into the transparent Image Instance Data File identified in bytes 4 and 5. The data for 
this image instance is found starting at this offset in the Image Instance Data File. 

Coding: 

- byte 6: high byte of offset into Image Instance Data File; 
byte 7: low byte of offset into Image Instance Data File. 

Bytes 8 and 9: Length of Image Instance Data. 

Contents: 

these bytes yield the length of the image instance data, starting at the offset identified in bytes 6 and 7. For the 
colour image coding scheme, as defined in annex B, the length of image instance data excludes the CLUT. 

Coding: 

- byte 8: high byte of Image Instance Data length; 

- byte 9: low byte of Image Instance Data length. 

NOTE: Transparent image instance data longer than 256 bytes may be read using successive READ BINARY 
commands. 



4.6.1 .2 EFmdf (Image Instance Data Files) 

Residing under DF GRAPH ics, there may be several image instance data files. Each Image Instance Data File contains data 
for one or more image instances. These Efs containing image instance data shall have the following attributes: 



Identifier: 


'4FXX' 


Structure: transparent 


Optional 


File size: Y bytes 


Update activity: low 


Access Conditions: 








READ 




PIN 






UPDATE 




ADM 






DEACTIVATE 


ADM 






ACTIVATE 


ADM 






Bytes 


Description 


M/O 


Length 


1 to Y 


Image Instance Data 


M 


Y bytes 



Contents and coding: 

- Image instance data are accessed using the image instance descriptors provided by EF IMG (see clause 4.6. 1.1). 

The identifier 4FXX' shall be different from one image instance data file to the other. For the range of 'XX', 
TS 31.101 [11]. The length Y maybe different from one image instance data file to the other. 

4.6.1 .3 EF| CE g ra p h i CS (In Case of Emergency - Graphics) 

This EF contains ICE graphical information, according to TS 22.101 [24]. 

This file shall be deactivated if the user does not wish the ICE information contained in this file to be available and 
activated if the user wishes the ICE information in this file to be available. 

For this EF the Total File Size data object shall be present within the FCP template in order for the ME to fit the picture 
to the available memory. 
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Structure of EF| CE _graphics at DFg raphics -level 



Identifier: '4F21' 



Structure: BER-TLV 



Optional 



SFI: Optional 



Record length: X 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



ALWAYS 
PIN 

PIN or Issuer Specified PIN (see Note) 
PIN or Issuer Specified PIN (see Note) 



Bytes 



Description 



M/O 



Length 



1 toX 



ICE graphics Data object 



M 



X bytes 



Note: The Issuer Specified PIN is a PIN with a global key reference (see TS 31 .101 [11]) 
specified by the card Issuer. 



ICE graphics Data Object 



Coding of the ICE graphics Data Objects 



Length 


Description 


Coding 


Status 


1 to T bytes (T < 3) 


ICE graphics Data Object tag 


As defined in TS 31.101 [11] 
for BER-TLV structured files 


M 


1 to L (L < 4) 


ICE graphics Data Object 
length 


As defined in TS 31.101 [11] 
for BER-TLV structured files 


M 


X-L-T bytes 


ICE graphics Content 


JPEG format 


M 



4.6.1.4 



EF 



LAUNCH SCWS 



Support of this EF is mandatory for a UICC that supports the Smart Card Web Server [59]. 

This EF contains the data for one or more launch facilities. A ME that supports the launch feature of the Smart Card 
Web Server shall read at least one of the launch facilities stored in EF LAUNC h sews and shall integrate them within the 
MMI in order to give the user the opportunity to launch a browser session with the Smart Card Web Server. 

The launch facility comprises an alpha identifier, a browser identity, a URL and zero or more icon descriptors. The ME 
shall present as many launch facilities to the user as it is able, starting with the first one, according to the following 
rules: 



• If no icon descriptor is provided, the ME shall use a ME specific default icon to present the launch facility to 
the user. The ME may also display the alpha identifier together with the icon. 

• If one or more icon descriptor(s) is/are provided, the ME may use the icon descriptors and, if required, the icon 
data retrieved from the referenced EF IC0N to decide which of the icons is most appropriate for its menu system. 
If the ME is able to use this data, if required so after appropriate resizing, it shall use the icon data to present 
the launch pad to the user. If indicated in the Icon Qualifier the ME may also display the alpha identifier 
together with the icon. If the icon data is not usable by the ME, a default launch mechanism shall be used. The 
fact that the icon data from one of the referenced EF IC on was retrieved may be used by the UICC as an 
indication that the launch pad is presented to the user. 

• As a minimum, terminals shall support the following icon format: 

PNG as specified in ISO/IEC 1 5948 [60] ; 
Icon size 32 x 32 pixel; 

indexed colour information with 8 bits per pixel. 
When the USIM sends a REFRESH proactive command for this file, the procedure given above shall be followed. 
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Structure of EF LA unch_scws at DFg raphics -level 



Identifier: '4F 01' 


| Structure: transparent 




Optional 


SFI: Optional 




File size: X bytes 


Update activity: low 


Access Conditions: 












READ 




ALW 










UPDATE 


ADM 










DEACTIVATE 


ADM 










ACTIVATE 


ADM 










Bytes 


Description 


M/O 


Length 


1 to M 


Launch SCWS TLV object(s) 


O 


M bytes 



This file may contain one or several Launch SCWS TLV object(s). Each Launch SCWS TLV object may contain 
one or more Icon Descriptor TLVs. The first URL TLV Object shall contain the Smart Card Web Server home 
page. The coding of the Launch SCWS TLV objects is described hereafter: 



Length 


Description 


Value 


Status 


1 byte 


Launch SCWS Tag 


'AO' 


M 


(14+X+W+Z) 


Length (see Note 2) 




M 


1 byte 


URL Tag 


'80' 


M 


1 byte 


Length (see Note 2) 




M 


W byte 


URL (starting page) 




M 


1 byte 


Alpha Identifier Tag 


'81' 


O 


1 byte 


Length (see Note 2) 




C 


Xbyte 


Alpha Identifier 




C 


1 byte 


Browser Identity Tag 


'82' 


O 


1 byte 


Length (see Note 2) 




C 


1 byte 


Browser Identity 




C 


1 byte 


Icon Descriptor Tag 


'83' or '84' (see Note 1 ) 


O 


1 byte 


Length (see Note 2) 




C 


5+Z byte 


Icon Descriptor 




C 


Note 1 : The tag value indicates the type and format of the Icon Link that is provided in the TLV value 
field (e.g. Tag '83' indicates that the Icon link is a URI, of which there shall only be one instance, while 
Tag '84' indicates that the Icon Link is the EFicon file ID). 
Note 2: coded according to ISO/IEC 8825-1 [35]. 
Note 3: C; if the Tag is present, this is mandatory. 



URL Tag '80': 

Contents: 

The URL shall point to a page of the Smart Card Web Server [59]. 
Coding: 
According to TS 31.111 [12] 
- Alpha Identifier Tag '81': 
Contents: 

The alpha identifier contains the text to be displayed by the ME together with a non-self-explanatory icon. 
Coding: 

According to TS 31.111 [12] 
Browser Identity Tag '82': 
Contents: 

The browser identity contains information about the type of browser to be used (e.g. HTML or WML 
browser). 

Coding: 
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According to TS 31.111 [12] 
Icon Descriptor Tag '83' or '84': 

The icon descriptor TLV contains information about the icon. 
- When the Icon Link is an URI, the Tag value shall be set to '83'. 



Length 


Description 


Value 




1 byte 


Icon Descriptor Tag 


'83' 




1 byte 


Length 




-When 


1 byte 


Icon Qualifier 




the Icon 


Z 


Icon Link 




Link is a 



pointer to 

the EF ICON file ID which contains the icon data (see clause 4.6.1.5), the Tag value shall be set to '84'. 



Length 


Description 


Value 


1 byte 


Icon Descriptor Tag 


'84' 


1 byte 


Length 




1 byte 


Icon Qualifier 




1 byte 


Icon Coding Scheme 




1 byte 


Icon Width 




1 byte 


Icon Height 




1 byte 


Bits per Pixel 




Z 


Icon Link 





Icon 
Qualifier: 



Contents: 

The icon qualifier indicates how the icon shall be used by the terminal. 
Coding: 

bit 1: = icon is self-explanatory, i.e. if displayed, it replaces the alpha identifier; 

1 = icon is not self-explanatory, i.e. if displayed, it shall be displayed together with the alpha 
identifier. 

bits 2 to 8 = RFU. 

Icon Coding Scheme: 

Contents: 

this byte identifies the image coding scheme that has been used in encoding the icon. 

Coding: Reference to a media type as defined in RFC 2046 [61] and registered with I AN A at 
http://www.iana.org/assignments/media-types/ . 

'00' - other media type as defined in EF IC0N ; 

'01' - "image/png"; 

'02' - "image/jpeg"; 

'03' - "image/gif"; 

'04' - "image/tiff; 

'05' - "image/vnd.microsoft.icon"; 

all other values - RFU. 

Icon Width: 

Contents: 

this byte specifies the icon width, expressed in pixel. 
Coding: 

binary. 
Icon Height: 
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• Contents: 

this byte specifies the icon height, expressed in pixel. 

• Coding: 

binary. 
Bits per pixel: 

• Contents: 

this byte specifies the number of bits that are used to code each pixel. 

• Coding: 

binary. 
Icon Link: 

• Contents: 

Link to the icon. This link shall point to a UICC resource. 

• Coding: 

- When the Tag value indicates an URI (i.e. Tag = '83') , the Icon Link shall be encoded to an octet string 
according to UTF-8 encoding rules as described in IETF RFC 3629 [48] (e.g. 

http://127.0.0.1:3516/pub/files/smartcardicon.jpg ). The URI shall point to a page of the Smart Card Web 
Server [59]. 

- When the Tag value indicates that the Icon Link contains file ID of the corresponding icon in EFicon (i-6- 
Tag = '84'), the Icon Link shall be encoded in binary. 

NOTE: Care has to be taken that the information in the icon descriptor matches the data retrieved from the 
referenced EF ICO n- Otherwise the terminal may revert to default behaviour. 

4.6.1.5 EFicon 

This EF contains the data for one icon. 



Structure of EF| CO n at DF gra p h ics-level 



Identifier: '4F XX' | 


Structure: transparent I Optional 


SFI: Optional 




File size: X bytes 


Update activity: low 


Access Conditions: 






READ 


ALW 




UPDATE 


ADM 




DEACTIVATE 


ADM 




ACTIVATE 


ADM 





Bytes Description M/O/C Length 



1 to M Media type TLV (tag = '80') C M bytes 

M+1 to M+N Icon data TLV (tag = '81 ') M N bytes 

M+N+1 to X |'FF' padding | O j X-M-N bytes 



If no reference in EF LAUNCH §qws P omts to it, an icon file may contain arbitrary values. 

Media type and icon data are coded as BER TLVs as defined in TS 101 220 [3]. The media type TLV shall be present if 
no media type is specified in the icon coding scheme of the entry in EF LAUNCH s^ W s that points to this file, else it is 
optional. 

Media type value part: 
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• Contents: 

Text string specifying the icon encoding. 

• Coding: 

As defined in RFC 2046 [61] and registered with IAN A at http://www.iana. org/assignments/media-types/ 
e.g. "image/png". 

Icon data value part: 

• Contents: 

The graphical data of the icon. 

• Coding: 

Binary data as defined for the respective media type. 

4.6.2 Contents of files at the DF PH onebook under the DFjelecom 

This DF has the same structure as DF PH onebook under the ADF US im- 

4.6.3 Contents of files at the DF MU ltimedia level 

The Efs in the Dedicated File DF M ultimedia contain multimedia information. This DF shall be present if service n°67 is 
available, i.e. if the card supports MMS storage. 

4.6.3.1 EF MML (Multimedia Messages List) 

If service n°67 is "available", this file shall be present. 

This file contains information about the MM data stored in EF MMDF . MM information are encapsulated in a BER-TLV 
data object. Each data object in EF MML points to a corresponding MM in EF MMDF . 



Identifier: '4F47' 


Structure: BER-TLV 


Optional 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
INVALIDATE 
REHABILITATE 


PIN 
PIN 

ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 toX 


MM Descriptor Data Object(s) 


M 


X bytes 



- MM Descriptor Data Object 

The content and coding are defined below: 
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Coding of the MM Descriptor Data Objects 



Lenath 


DescriDtion 


Codina 


Status 


1 tn A hvtps I A < 31 


MM Dp^rrintnr D?itp Ohiprt tpn 

i vi i vi L/cooi ijJiui ljclicl v^ujcoi iciy 


As dpfinpd in TS 31 101 1111 

no uciii icu iii i \j u i . i u i ii ij 

for BER-TLV structured files 


M 


1 to B bytes (B < 4) 


MM Descriptor Data Object length 


As defined in TS 31.101 [11] 
for BER-TLV structured files 


M 


1 byte 


MMS Implementation tag '80' 




M 


1 byte 


MMS Implementation length 




M 


1 byte 


MMS Implementation 


See below 


M 


1 byte 


MM File Identifier / SFI tag '81 ' 




M 


1 byte 


MM File Identifier /SFI length 




M 


1 or 2 bytes 


MM File Identifier /SFI 


See below 


M 


1 byte 


MM Content Data Object Tag tag '82' 




M 


1 byte 


MM Content Data Object Tag length 




M 


1 to C bytes (C < 3) 


MM Content Data Object Taq 


See below 


M 


1 byte 


MM Size tag '83' 




M 


1 byte 


MM Size length 




M 


1 to D bytes (D < 4) 


MM Size in bytes 


See below 


M 


1 byte 


MM Status tag '84' 




M 


1 byte 


MM Status length 




M 


2 bytes 


MM Status 


See below 


M 


1 byte 


MM Alpha Identifier tag '85' 




M 


1 byte 


MM Alpha Identifier length 




M 


1 to E bytes 


MM Alpha Identifier 


See below 


M 



- MMS Implementation 
Contents: 

The MMS Implementation indicates the used implementation type, e.g. WAP. 

Coding: 
Allocation of bits: 
Bit number Parameter indicated 

1 WAP implementation of MMS 

2 to 8 Reserved for future use 

Bit value Meaning 

Implementation not supported. 

1 Implementation supported. 

- MM File Identifier / SFI 
Contents: 

file identifier or SFI of EF MMDF which contains the actual MM message. If the length of this TLV object is 
equal to 1 then the content indicates the SFI of the EF MMDF , the SFI is coded on bl to b5. Otherwise the TLV 
contains the file identifier. 

Coding: 
according to TS 31.101 [11]. 

- MM Content Data Object Tag 
Contents: 

tag indentifying a MM (i.e. identifying a data object) within EF MMDF . 

Coding: 
according to TS 31.101 [11]. 

- MM Size 
Contents: 

size of the corresponding MM stored in EF M mdf- 
Coding: 

according to TS 31.101 [11]. 



- MM Status 
Contents: 

The status bytes contain the status information of the stored Multimedia Message. 
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Coding: 
First byte: 

bit bl indicates whether the MM has been read or not. Bit b2 indicates the MM forwarding status. Bit b3 indicates 
whether it is a received MM or an originated MM. Bits b4 to b8 are reserved for future use. 

Second byte: 

Coding of the second byte depends on whether the MM has been identified as a received MM or originated MM in the 
first byte: 

- Received MM coding: 

bits bl and b2 are used to provide information on Read-reply reports. Bits b3 to b8 are reserved for 
future use. 

- Originated MM coding: 

bit bl is used to provide information on Delivery -report. Bits b2 to b8 are reserved for future use. 

First byte: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 






















MM read, bit = 1 / MM not read, bit = 
MM forwarded, bit = 1 

Received MM, bit = 1 / Originated MM, bit = 
RFU, bit = 



Second byte coding for Received MM: 



b8 


b7 


bG 


b5 


b4 


b3 


b2 


bl 



Read-reply report requested, bit = 1 
Read-reply report sent, bit = 1 
Read-reply report created, bit = 1 
Delivery report requested, bit = 1 
Delivery report creation allowed, bit = 1 
RFU, bit = 

Second byte coding for Originated MM: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Delivery report received, bit = 1 
Delivery report requested, bit = 1 
Read-Reply report requested, bit = 1 
Read-Reply report received, bit = 1 
MM sent, bit = 1 
RFU, bit = 

- MM Alpha Identifier 
Contents: 

information about the MM to be displayed to the user (e.g. sender, subject, date etc). 
Coding: 

this alpha identifier shall use either: 
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- the SMS default 7-bit coded alphabet as defined in TS 23.038 [5] with bit 8 set to 0. The alpha 
identifier shall be left justified. Unused bytes shall be set to 'FF'; 

- or one of the UCS2 coded options as defined in the annex of TS 31.101 [11]. 

4.6.3.2 EFmmdf (Multimedia Messages Data File) 

If service n°67 is "available", this file shall be present. 

Residing under DF MULTIMEDIA , this EF contains Multimedia Messages data. The structure of this EF is BER-TLV (see 
TS 31.101 [11]). Each MM in this file is identified by a tag. The tag value for a particular MM in this file is stored in 
EF M ml- 



Identifier: '4F48' 


\ Structure: 


BER-TLV 




Optional 


| Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/O 


Length 


1 toX 


MM Content Data Object(s) 


M 


X bytes 



- MM Content Data Object 

The content and coding are defined below: 



Coding of the MM Content Data Objects 



Length 


Description 


Coding 


Status 


1 to T bytes (T < 3) 


MM Content Data Object tag 


As defined in TS 31.101 [11] 
for BER-TLV structured files 


M 


1 to L (L < 4) 


MM Content Data Object length 


As defined in TS 31.101 [11] 
for BER-TLV structured files 


M 


X-L-T bytes 


MM Content 


According to MMS 
Implementation 


M 



Contents: 

The Multimedia Message content consists of MM headers and a message body. The content of the Multimedia Message 
data depends on whether the MM has been identified as a received MM or an originated MM: 

- For a received message, the stored Multimedia Message data consists of the information elements (i.e. 
relevant MM control information and MM content) of the MMl_retrieve.RES (see TS 23.140 [38]). 

For an originated message, the stored Multimedia Message data consists of the information elements (i.e. 
relevant MM control information and MM content) of the MMl_submit.REQ (see TS 23.140 [38]). 

Coding: 

The MM data encapsulation scheme and encoding rules are defined by the MMS Implementation. 
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4.7 Files of USIM 

This clause contains two figures depicting the file structure of the UICC and the ADF US im- ADF US im shall be selected 
using the AID and information in EF DIR . 



MF 
1 3F00 ' 



DF GSM 
1 7F20 1 



see TS 
51.011 [16 



ef dir 
' 2F00 1 



EF PL 
1 2F05 1 



EFarr 
1 2F06 1 



ef iccid 
' 2FE2 1 



DF TELECO m 
' 7F10 1 





DF GRAPHICS 




1 5F50 ' 





DFpHQNEBOOK 




1 5F3A' 





DF MULTIMEDIA 




1 5F3B' 



EF ARR 

1 6F06 1 



ef smsp 
' 6F42 1 



ef exti 
' 6F4A 1 



ef eccp 
1 6F4F ' 



ef psismsc 
' 6FE5 1 



EF IMG 
' 4F2 1 



EF PSC 
' 4F22 1 



ef ccpi 
' 4 FXX 1 



EF GRP 

' 4 FXX 1 



EF 



EMAIL 

4 FXX 1 



EF MML 

' 4F47 1 



EF ADN 

1 6F3A' 



EF FDN 
1 6F3B 1 



EF SMS 

' 6F3C 



EF SMSS 

1 6F43 ' 



EF LND 

1 6F44 1 



EF SMSR 

' 6F47 1 



EF EXT2 

1 6F4B' 



EF 



EXT3 

6F4C 



EF BDN 

1 6F4D 1 



EF RMA 

1 6F53 ' 



EF SUME 

' 6F54 1 



EF ICE_DN 

' 6FE0 1 



EF 



IIDFn 

4 FXX' 



EF 



ICE graphics 

1 4F21 ' 



EF 



LAUNCH SCWS 

1 4F01 1 



EF CC 
1 4F23 1 



ef puid 
'4F24 1 



EF PBR 

1 4F3 1 



EE IAP 

1 4 FXX 1 



EPadn 
1 4 FXX 1 



EF EXT1 

' 4 FXX 1 



EF AAS 

1 4 FXX ' 



EF GAS 

1 4 FXX 1 



EF ANR 

1 4 FXX 1 



EF MMDF 

i 4F48 ' 



EF MSISD1 

1 6F40 1 



EF SDN 

1 6F49 ' 



EF 



EXT4 

6F4E' 



EF ICE_PF 

1 6FE1 ' 



EF ICON 

1 4 FXX 1 



EF UID 

1 4 FXX ' 



EF PBC 
1 4 FXX 1 



EF SHE 

1 4 FXX ' 
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1 5F3C 



See 
C.S0074- 
A[53] 



NOTE 1 : Files under DFtelecom with shaded background are defined in TS 51 .01 1 [1 8]. 

NOTE 2: The value '6F65' under ADFUSIM was used in earlier versions of this specification, and should not be re- 
assigned in future versions. 
NOTE 3: Files under DFmmss are defined in C.S0074-A [53]. 

Figure 4.1 : File identifiers and directory structures of UICC 



ADF TT 



EF LI 
' 6F05 1 



EF DCK 

1 6F2C 



EF flCM 
' 6F39 1 



ef msisdn 
' 6F40 1 



EF SPN 

' 6F46 1 



EF EXT3 

' 6F4C 



ef ext4 
' 6F55 1 



E ^THRESHOLD 

' 6F5C 



EF flCC 
' 6F78 1 



EF ICT 
1 6F82 1 



EF VBS 

' 6FB3 1 



^■■^"Hiddenkey 

' 6FC3 1 



EF EXT6 

' 6FC8 1 



EF SPDI 

' 6FCD 1 



ef mmsucp 
' 6FD2 1 



EF ARR 

1 6F06 ' 



EF 



IMSI 

6F07 1 



EF HPPLMN 

1 6F31 ' 



EF CNL 

1 6F32 1 



EE FDN 

1 6F3B' 



EF SMS 

1 6F3C 



EF PDCT 
1 6F41 ' 



EE SMSP 

' 6F42 1 



EF SMSR 

1 6F47 ' 



EF CBMID 

' 6F48 1 



EF BDN 

1 6F4D' 



EE EXT5 

' 6F4E 1 



EF EST 
1 6F56 ' 



EF ACL 

1 6F57 1 



EF PLMNwAcT 
1 6F60 ' 



EF 



OPLMNwAcT 

6F61 1 



EF FPLMN 

1 6F7B' 



EF LOCI 

1 6F7E' 



EF 0CT 
1 6F83 ' 



EF AD 

' 6 FAD ' 



EF 



VBSS 

6FB4 ' 



EF, 



eMLPP 

6FB5 ' 



E FjjETPAR 

1 6FC4 ' 



EF PNN 

' 6FC5 ' 



EF MBI 
1 6FC9 ' 



EF MWIS 

1 6FCA ' 



EF MMSN 

1 6FCE 1 



EF EXT8 

1 6FCF ' 



EF NIA 

1 6FD3 ' 



EF VGCSCA 

1 6FD4 ' 



EF 



Keys 

6F08 1 



EE ACMmax 

' 6F37 1 



EE GID1 

' 6F3E 1 



EE SMSS 

' 6F43 1 



EF SDN 

' 6F49 1 



EF CCP2 

' 6F4F 1 



EF CMI 
1 6F58 1 



EF, 



HPLMNwAcT 

6F62 1 



EF ICI 
' 6F80 1 



EF 

VGCS 

1 6FB1 1 



EF AaeM 

' 6FB6 1 



EE OPL 

' 6FC6 1 



EF CPIS 
' 6FCB 1 



EF, 



MMSICP 

6FD0 1 



EF VBSCA 

' 6FD5 1 



EF 



KeysPS 

6F09 1 



EF UST 
1 6F38 ' 



EF GID2 

1 6F3F' 



EF CBMI 

1 6F45 ' 



EF EXT2 

1 6F4B' 



EF CBMIR 

1 6F50 ' 



EF 



START-HFN 

6F5B' 



EF PSLOCI 

1 6F73 ' 



EE OCI 

1 6F81 ' 



EF VGCSS 

1 6FB2 ' 



EF ECC 
1 6FB7 ' 



EF MBDN 

1 6FC7 ' 



EF 



EXT 7 

6 FCC 



EF 



MMSUP 

6FD1 ' 



EF GBAP 

1 6FD6 ' 
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FF MSK 
' 6FD7 1 



FF MUK 
1 6FD8 ' 



EF 



EHPLMN 

6FD9 ' 



FjF GBfllJL 
' 6 FDA ' 



EF 



EHPLMNPI 

6FDB ' 
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DF 



PHONEBOOK 

5F3A' 



T 



DF, 



GSM-ACCESS 

5F3B' 



1 5F3C 



DF 

SoLSfl 

1 5F70 ' 



DF 

WLAN 

1 5F40 ' 



DF HNB 

1 5F50 ' 



ef lrplmnsi 
' 6FDC 1 



ef epsloci 
' 6FE3 1 



EF PSC 

'4F22 1 



EF CCP1 
' 4 FXX 1 



EF GRP 

' 4 FXX 1 



EF 



EMAIL 

4 FXX 1 



EF Kc 
1 4F20 1 



EF 



MexE-ST 

4F4 1 



ef sai 
' 4F3 1 



^^Pseudo 

'4F41 1 



ef wri 
' 4F46 ' 



EF 



HPLMNDAI 

4F4B 1 



EF ACSGL 

' 4F81 1 



EF NAFKCA 

1 6 FDD 1 



EF SPNI 

1 6FDE 1 



EF EPSNSC 

1 6FE4 ' 



EF aFC 
1 6FE6 1 



EF CC 
1 4F23 1 



EF PUID 

'4F24 1 



EF IAP 

1 4 FXX ' 



EF ADN 

1 4 FXX 1 



EF AAS 

1 4 FXX ' 



EF GAS 

1 4 FXX ' 



EF KcGPRS 

1 4F52 ' 



EF 



CPBCCH 

4F63 1 



EF ORPK 

i 4F41 . 



EF ARPK 

i 4F42 ' 



EF SLL 

1 4F31 ' 



EF 



UPLMNWLAW 

4F42 ' 



EF 0PLMNWLAN 

i 4F43 ' 



EF HWSIDL 

i 4F47 ' 



EF, 



WEHPLMKPI 

4F48 ' 



EF CSGT 

' 4F82 1 



EF HNBN 

' 4F83 1 



EF PNNI 

' 6FDF 1 



EF UICCIARI 

' 6FE7 1 



EF PBR 

1 4F3 1 



EF EXT1 

' 4 FXX 1 



EF ANR 

' 4 FXX 1 



EF invSCAN 

' 4F64 1 



EF TPRK 

' 4F4 3 1 



EF UWSIDL 

'4F44 1 



EF WHPI 

i 4F49 1 



EF OCSGL 

i 4F84 1 



EF NCP-IP 

1 6FE2 ' 



EF 



NASCONFIG 

6FE8 ' 



EF UID 

1 4 FXX ' 



EF PBC 
1 4 FXX 1 



EF SNE 

1 4 FXX ' 



EF TKCDF 
1 4 FXX ' 



EF OWSIDL 

1 4F45 ' 



EF WLRPLMN 

i 4F4A' 



EF OCSGT 

1 4F85 ' 



EF n 
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' 4F86 1 



Figure 4.2: File identifiers and directory structures of USIM 



5 Application protocol 

The requirements stated in the corresponding section of TS 31.101 [11] apply to the USIM application. 

The procedures listed in clause "USIM management procedures" are required for execution of the procedures in the 
subsequent clauses "USIM security related procedures" and "Subscription related procedures". The procedures listed in 
clauses "USIM security related procedures" are mandatory. The procedures listed in "Subscription related procedures" 
are only executable if the associated services, which are optional, are provided in the USIM. However, if the procedures 
are implemented, it shall be in accordance with clause "Subscription related procedures". 

If a procedure is related to a specific service indicated in the USIM Service Table, it shall only be executed if the 
corresponding bits denote this service as "service available" (see clause "EF UST "). In all other cases the procedure shall 
not start. 

5.1 USIM management procedures 

If a USIM application is present on the UICC, a 3GPP ME shall only use the USIM application regardless of the radio 
access technology in use. In this case, a possibly existing SIM application shall never be used by a 3GPP ME. 

5.1.1 Initialisation 

5.1 .1 .1 USIM application selection 

After UICC activation (see TS 31.101 [11]), the ME selects a USIM application. If no EF DIR file is found or no USIM 
applications are listed in the EF DIR file, the ME may then try to select the GSM application as specified in 
TS 51.011 [18]. 

NOTE: there may be cards that need to be reset before selecting the GSM application. 

After a successful USIM application selection, the selected USIM (AID) is stored on the UICC. This application is 
referred to as the last selected USIM application. The last selected USIM application shall be available on the UICC 
after a deactivation followed by an activation of the UICC. 

If a USIM application is selected using partial DF name, the partial DF name supplied in the command shall uniquely 
identify a USIM application. Furthermore if a USIM application is selected using a partial DF name as specified in 
TS 31.101 [11] indicating in the SELECT command the last occurrence the UICC shall select the USIM application 
stored as the last USIM application. If, in the SELECT command, the options first, next/previous are indicated, they 
have no meaning if an application has not been previously selected in the same session and shall return an appropriate 
error code. 

5.1.1.2 USIM initialisation 

The ME requests the emergency call codes. For service requirements, see TS 22.101 [24]. 

The ME requests the Language Indication. The preferred language selection shall always use the EF LI in preference to 
the EF PL at the MF unless any of the following conditions applies: 

if the EF LI has the value 'FFFF' in its highest priority position, then the preferred language selection shall be the 
language preference in the EF PL at the MF level according the procedure defined inTS 31.101 [11]; 

if the ME does not support any of the language codes indicated in EF LI , or if EF LI is not present, then the 
language selection shall be as defined in EF PL at the MF level according the procedure defined in 
TS 31.101 [11]; 
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- if neither the languages of EF LI nor EF PL are supported by the terminal, then the terminal shall use its own 
internal default selection. 

The ME then runs the user verification procedure. If the procedure is not performed successfully, the USIM 
initialisation stops. 

The ME performs the administrative information request. 
The ME performs the USIM Service Table request. 
The ME performs the Enabled Services Table Request. 

In case FDN is enabled, an ME which does not support FDN shall allow emergency calls but shall not allow MO-CS 
calls andMO-SMS. 

If BDN is enabled, an ME which does not support Call Control shall allow emergency calls but shall not allow MO-CS 
calls. 

If ACL is enabled, an ME which does not support ACL shall not send any APN to the network. 

If all these procedures have been performed successfully then 3G session shall start. In all other cases 3G session shall 
not start. 

Afterwards, the ME runs the following procedures if the ME and the USIM support the related services: 
IMSI request; 

Access control information request; 

- Higher Priority PLMN search period request; 

- EHPLMN request 

- HPLMN selector with Access Technology request; 

- User controlled PLMN selector with Access Technology request; 

- Operator controlled PLMN selector with Access Technology request; 
GSM initialisation requests; 

Location Information request for CS-and/or PS-mode and/or EPS; 

- Cipher key and integrity key request for CS- and/or PS-mode; 

- EPS NAS Security Context request for EPS ; 

- Forbidden PLMN request; 

- Initialisation value for hyperframe number request; 

- Maximum value of START request; 

- CBMID request; 

- Depending on the further services that are supported by both the ME and the USIM the corresponding Efs have 
to be read. 

After the USIM initialisation has been completed successfully, the ME is ready for a 3G session and shall indicate this 
to the USIM by sending a particular STATUS command. 

5.1 .1 .3 GSM related initialisation procedures 

If GSM access is enabled the following procedures shall be performed if the applicable service is enabled and if the ME 
supports the GSM compact access technology. 

- Investigation Scan request; 
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- CPBCCH information request. 

5.1 .2 Session termination 

5.1 .2.1 3G session termination 

NOTE 1: This procedure is not to be confused with the deactivation procedure in TS 31.101 [11]. 
The 3G session is terminated by the ME as follows. 

The ME shall indicate to the USIM by sending a particular STATUS command that the termination procedure is 
starting. 

The ME then runs all the procedures which are necessary to transfer the following subscriber related information to the 
USIM, if the ME and the USIM support the related services: 

- Location Information update for CS-and/or PS-domain and/or EPS. 

- Cipher Key and Integrity Key update for CS-and/or PS-domain. 

- EPS NAS Security Context update for EPS domain. 
Advice of Charge increase. 

- Forbidden PLMN update. 

- GSM Termination procedures. 

Finally, the ME deletes all these subscriber related information elements from its memory. 

NOTE 2: If the ME has already updated any of the subscriber related information during the 3G session, and the 
value has not changed until 3G session termination, the ME may omit the respective update procedure. 

To actually terminate the session, the ME shall then use one of the mechanisms described in TS 31.101 [11]. 

5.1.2.1.1 GSM termination procedures 

If GSM access is enabled the following termination procedures shall be performed if the applicable service is enabled. 

- CPBCCH information update (if the ME supports the GSM compact access technology); 

5.1 .2.2 3G session reset 

The ME shall follow the 3G session termination procedure defined above except that the ME shall use the Application 
session reset procedure as described in TS 31.101 [11] instead of one of the mechanisms to terminate the session. 

5.1 .3 USIM application closure 

After termination of the 3G session as defined in 5.1.2 the USIM application may be closed by closing the logical 
channels that are used to communicate with this particular USIM application. 

5.1 .4 Emergency call codes 

Request: The ME performs the reading procedure with EF ECC . If EF ECC does not contain any valid number, 

the ME shall use the emergency numbers it stores for use in setting up an emergency call without a 
USIM. 

Update: The ME performs the updating procedure with EF EC c- 

NOTE: The update procedure is only applicable when access conditions of ADM for update is set to ALW, PIN 
or PIN2. 
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5.1 .5 Language indication 

Request: The ME performs the reading procedure with EF LI . 

Update: The ME performs the updating procedure with EF LI . 

5.1 .6 Administrative information request 

The ME performs the reading procedure with EF AD . 

5.1 .7 USIM service table request 

The ME performs the reading procedure with EF UST . 

5.1.8 Void 

5.1 .9 UICC presence detection 

The ME checks for the presence of the UICC according toTS 31.101 [11] within all 30 s periods of inactivity on the 
UICC-ME interface during a call. If the presence detection according to TS 31.101 [11] fails the call shall be terminated 
as soon as possible but at least within 5s after the presence detection has failed. Here a call covers a circuit switched 
call, and/or an active PDP context. 

5.2 USIM security related procedures 

5.2.1 Authentication algorithms computation 

The ME selects a USIM application and uses the AUTHENTICATE command (see 7.1.1). The response is sent to the 
ME (in case of the T=0 protocol when requested by a subsequent GET RESPONSE command). 

After a successful AUTHENTICATE command, the ME shall perform cipher and integrity key update procedure. 

5.2.2 IMSI request 

The ME performs the reading procedure with EF!m SI . 

5.2.3 Access control information request 

The ME performs the reading procedure with EF AC c. 

5.2.4 Higher Priority PLMN search period request 

The ME performs the reading procedure with EF H pplmn- 

5.2.5 Location information 

Request: The ME performs the reading procedure with EF LO ci- 

Update: The ME performs the updating procedure with EF LO ci- 

In the case when updating EF LO ci with data containing the TMSI value and the card reports the error '6581' (Memory 
Problem), the ME shall terminate 3G operation. 

5.2.6 Cipher and Integrity key 

Request: The ME performs the reading procedure with EF Keys . 
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Update: The ME performs the updating procedure with EF Keys . 

5.2.7 Forbidden PLMN 

Request: The ME performs the reading procedure with EF FPLMN . 

Update: The ME performs the updating procedure with EF FPLM n- 

5.2.8 Void 

5.2.9 User Identity Request 

The ME selects a USIM and performs the reading procedure with EF^s:. 

5.2.10 GSM Cipher key 

Requirement: Service n°27 "available". 

Request: The ME performs the reading procedure with EF Kc - 

Update: The ME performs the updating procedure with EF Kc . 

5.2.11 GPRS Cipher key 

Requirement: Service n°27 "available". 

Request: The ME performs the reading procedure with EF Kc gprs- 

Update: The ME performs the updating procedure with EF KcGPRS . 

5.2.12 Initialisation value for Hyperframe number 

Request: The ME performs the reading procedure with EF START . HFN . 

Update: The ME performs the updating procedure with EF START . HFN . 

5.2.13 Maximum value of START 

Request: The ME performs the reading procedure with EF TH reshold- 

5.2.14 HPLMN selector with Access Technology request 

Request: The ME performs the reading procedure with EF HPLMNwAcT 

5.2.15 Packet Switched Location information 

Request: The ME performs the reading procedure with EF PSLO ci- 

Update: The ME performs the updating procedure with EF PS loci- 

5.2.1 6 Cipher and Integrity key for Packet Switched domain 

Request: The ME performs the reading procedure with EF Keys ps- 

Update: The ME performs the updating procedure with EF KeysPS . 
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5.2.17 LSA information 

Requirement: Service n°23 "available". 

Request: The ME performs the reading procedure with EF SAI , EF SLL and its associated LSA Descriptor files. 

Update: The ME performs the updating procedure with EF S ll- 

5.2.18 Voice Group Call Services 

Requirement: Service n°57 "available". 
Voice Group Call Service 

Request: The ME performs the reading procedure with EFVGCS. 

Voice Group Call Service Status 

Request: The ME performs the reading procedure with EFVGCSS. 

Update: The ME performs the updating procedure with EFVGCSS. 

5.2.19 Voice Broadcast Services 

Requirement: Service n°58 "available". 
Voice Broadcast Service 

Request: The ME performs the reading procedure with EF V bs- 

Voice Broadcast Service Status 

Request: The ME performs the reading procedure with EF V bss- 

Update: The ME performs the updating procedure with EF V bss- 

5.2.20 Generic Bootstrapping architecture (Bootstrap) 

The ME uses the AUTHENTICATE command in GBA security context (Bootstrapping Mode) (see 7.1.1). The 
response is sent to the ME. 

After a successful GBA_U Procedure, the ME shall update the B-TID field and the Key Life Time field in EFqbabp 

5.2.21 Generic Bootstrapping architecture (NAF Derivation) 

The ME shall first read EF GBABP . The ME then uses the AUTHENTICATE command in GBA security context (NAF 
Derviation Mode) (see 7.1.1). The response is sent to the ME. 

5.2.22 MSK MIKEY Message Reception 

The ME performs the reading of EF MUK and retrieves the Time Stamp Counter Value associated with the involved 
MUK. Then it proceeds with Timestamp Payload checking as described in TS 33.246 [43]. 

5.2.23 MTK MIKEY Message Reception 

The ME performs the reading of EF MSK and retrieves the Time Stamp Counter Value associated with the involved MSK. 
Then it proceeds with Timestamp Payload checking as described in TS 33.246 [43]. 
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5.2.24 Void 

5.2.25 EHPLMN request 

Requirement: Service n°71 "available". 

Request: The ME performs the reading procedure with EF EHPLMN . 

5.2.26 Last RPLMN Selection Indication request 

Requirement: Service n°74 "available". 

Request: The ME performs the reading procedure with EF LRPLMNSI . 

5.2.27 EPS Location Information 

Requirement: Service n°85 "available". 

Request: The ME performs the reading procedure with EF EPS loci- 

Update: The ME performs the updating procedure with EF EPSLO ci. 

5.2.28 EPS NAS Security Context 

Requirement: Service n°85 "available". 

Request: The ME performs the reading procedure with EF EPSNSC . 

Update: The ME performs the updating procedure with EF EPSNSC 

In order to prevent UICC memory wear out due to excessive writing, the update of EPS NAS security context shall be 
according to the rules and procedures specified in TS 33.401 [52]. 

5.2.29 Non Access Stratum Configuration 

Requirement: Service n°96 "available". 

Request: The ME performs the reading procedure with EF NAS config- 

The parameters in EF NASCO nfig shall take precedence over the parameters stored in the ME non-volatile memory. 

5.3 Subscription related procedures 

5.3.1 Phone book procedures 

5.3.1.1 Initialisation 

The ME first reads the content of EF PB r to determine the configuration phonebook. If the EF IAP file is indicated in EF PB r 
following tag 'A8' the ME reads the content of EF IAP in order to establish the relation ship between the content in the 
files indicated using tag A9' and files indicated by tag A8'. The ME may read the contents of the phone book related 
files in any order. 

5.3.1 .2 Creation/Deletion of information 

In order to avoid unlinked data to introduce fragmentation of the files containing phone book data the following 
procedures shall be followed when creating a new entry in the phone book. The data related to EF ADN is first stored in 
the relevant record. As the record number is used as a pointer the reference pointer is now defined for the entry. The 
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rule for storing additional information for an entry is that the reference pointer shall be created before the actual data is 
written to the location. 

In case of deletion of a complete or part of an entry the data shall be deleted first followed by the reference pointer for 
that data element. In case of deletion of a complete entry the contents of EF ADN is the last to be deleted. 

5.3.1 .3 Hidden phone book entries 

If a phone book entry is marked as hidden by means of EF PBC the ME first prompts the user to enter the 'Hidden Key'. 
The key presented by the user is compared against the value that is stored in the corresponding EF Hiddenkey . Only if the 
presented and stored hidden key are identical the ME displays the data stored in this phone book entry. Otherwise the 
content of this phone book entry is not displayed by the ME. 

Even if the terminal does not support the Hidden Key Procedures, a hidden phone book entry shall not be displayed by 
the terminal. 

Request: The ME performs the reading procedure with EF H iddenkey 

Update: The ME performs the updating procedure with EF H iddenkey 

5.3.2 Dialling numbers 

Requirements: 

- Service n°l "available" for ADN located under the local phonebook; 

- Presence of EFad N in EF PB r for ADN located under the global phonebook; 

- Presence of EFanr in EF PBR for ANR; 

- Service n°2 "available" for FDN; 

- Service n°21 "available" for MSISDN; 

- Service n°4 "available" for SDN; 

- Service n°6 "available" for BDN; 

- Service n°8 "available" for EFOCI; 

- Service n°9 "available" for EFICI. 

The following procedures may not only be applied to EF ADN and its associated extension files EF CCP i and EF EX ti as 
described in the procedures below, but also to EFanr, EF fdn , EF msisdn , EF bdn , EF sdn , EF ci, EF ici , and EF MBDN and 
their associated extension files. If these files are not "available", as denoted in the USIM service table, the current 
procedure shall be aborted and the appropriate Efs shall remain unchanged. 

As an example, the following procedures are described as applied to ADN. 

Update: The ME analyses and assembles the information to be stored as follows (the byte identifiers used 

below correspond to those in the definition of the relevant Efs in the present document): 

i) The ME identifies the Alpha-tagging, Capability/Configurationl Record Identifier and Extensionl Record 
Identifier. 

ii) The dialling number/SSC string shall be analysed and allocated to the bytes of the EF as follows: 

- if a "+" is found, the TON identifier is set to "International"; 

- if 20 or less "digits" remain, they shall form the dialling number/SSC string; 
if more than 20 "digits" remain, the procedure shall be as follows: 

The ME seeks for a free record in EF EX ti- If an Extensionl record is not marked as "free", the ME runs the Purge 
procedure. If an Extensionl record is still unavailable, the procedure is aborted. 
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The first 20 "digits" are stored in the dialling number/SSC string. The value of the length of BCD number/SSC 
contents is set to the maximum value, which is 11. The Extension 1 record identifier is coded with the associated record 
number in the EF EX ti- The remaining digits are stored in the selected Extension 1 record where the type of the record is 
set to "additional data". The first byte of the Extensionl record is set with the number of bytes of the remaining 
additional data. The number of bytes containing digit information is the sum of the length of BCD number/SSC contents 
of EF ADN and byte 2 of all associated chained Extensionl records containing additional data. 

iii) If a called party subaddress is associated to the ADN/SSC the procedure shall proceed as follows: 

- If the length of the called party subaddress is less than or equal to 1 1 bytes (see TS 24.008 [9] for coding): 

The ME seeks for a free record in EF EXT1 . If an Extensionl record is not marked as "free", the ME runs the Purge 
procedure. If an Extensionl record is still unavailable, the procedure is aborted. 

- The ME stores the called party subaddress in the Extensionl record, and sets the Extensionl record type to "called 
party subaddress". 

- If the length of the called party subaddress is greater than 1 1 bytes (see TS 24.008 [9] for coding): 

- The ME seeks for two free records in EF EXT1 . If no such two records are found, the ME runs the Purge 
procedure. If two Extensionl records are still unavailable, the procedure is aborted. 

The ME stores the called party subaddress in the two Extensionl records. The identifier field in the 
Extensionl record containing the first part of the subaddress data is coded with the associated EF EX ti 
record number containing the second part of the subaddress data. Both Extensionl record types are set to 
"called party subaddress". 

Once i), ii), and iii) have been considered the ME performs the updating procedure with EF ADN . If the USIM has no 
available empty space to store the received ADN/SSC, or if the procedure has been aborted, the ME advises the user. 

For reasons of memory efficiency, the ME may analyse all Extensionl records to recognise if the additional or 
subaddress data to be stored is already existing in EF EXT1 . In this case, the ME may use the existing chain or the last part 
of the existing chain from more than one ADN. The ME is only allowed to store extension data in unused records. If 
existing records are used for multiple access, the ME shall not change any data in those records to prevent corruption of 
existing chains. 

Erasure: The ME sends the identification of the information to be erased. The content of the identified 

record in EFadn is marked as "free". 

Request: The ME sends the identification of the information to be read. The ME shall analyse the data of 

EFADNto ascertain, whether additional data is associated in EF EXT1 or EF CCP1 . If necessary, then the 
ME performs the reading procedure on these Efs to assemble the complete ADN/SSC. 

Purge: The ME shall access each EF which references EF EXT i (EF EXT2 , EF EXT6 ) for storage and shall 

identify records in these files using extension data (additional data or called party subaddress). 
Note that existing chains have to be followed to the end. All referred Extensionl (Extension2, 
Extension6) records are noted by the ME. All Extensionl (Extension2, Extension6) records not 
noted are then marked by the ME as "free" by setting the whole record to EF'. 

The following three procedures are only applicable to service n°2 (FDN). 

FDN capability request. The ME shall check the state of service n°2, i.e. if FDN is "enabled" or "disabled". If FDN is 
enabled, the ME shall only allow outgoing calls as defined in the fixed number dialling description in TS 22.101 [24]. 
To ascertain the state of FDN, the ME shall check in EF UST and EF EST if FDN is enabled (service activated and 
available). In all other cases service n°2 is disabled. 

FDN enabling is done by activating the FDN service in EF EST . 

FDN disabling is done by deactivating the FDN service in EF EST . 

The following three procedures are only applicable to service n°6 (BDN). 

- BDN capability request. The ME shall check the state of service n°6, i.e. if BDN is "enabled" or "disabled". To 
ascertain the state of BDN, the ME shall check in EF UST and EF EST if BDN is "enabled" (service available and 
activated). In all other cases, the BDN service is "disabled". 
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- BDN enabling is done by activating the BDN service in EF EST . 

- BDN disabling is done by deactivating the BDN service in EF EST . 

5.3.3 Short messages 

Requirement: Service n°10 "available". 

Request: The USIM seeks for the identified short message. If this message is found, the ME performs the 

reading procedure with EF S ms- 

If service n°10 is "available" and the status of the SMS is 'ID' (status report requested, received 
and stored in EF S msr)> the ME performs the reading procedure with the corresponding record in 
EFsmsr- If the ME does not find a corresponding record in EF SM sr, then the ME shall update the 
status of the SMS with '15' (status report requested, received but not stored in EF S msr)- 

If the short message is not found within the USIM memory, the USIM indicates that to the ME. 

Update: The ME looks for the next available area to store the short message. If such an area is available, it 

performs the updating procedure with EF SMS . 

If there is no available empty space in the USIM to store the received short message, a specific 
MMI will have to take place in order not to loose the message. 

Erasure: The ME will select in the USIM the message area to be erased. Depending on the MMI, the 

message may be read before the area is marked as "free". After performing the updating procedure 
with EF SMS , the memory allocated to this short message in the USIM is made available for a new 
incoming message. The memory of the USIM may still contain the old message until a new 
message is stored in this area. 

If service n°l 1 is "available" and the status of the SMS is 'ID' (status report requested, received 
and stored in EF SMSR ), the ME performs the erasure procedure for EF SMSR with the corresponding 
record in EF SMSR . 

5.3.4 Advice of charge 

Requirement: Service n° 13 "available". 
Accumulated Call Meter. 

Request: The ME performs the reading procedure with EF AC m- The USIM returns the last updated value of 

the ACM. 

Initialisation: The ME performs the updating procedure with EF ACM using the new initial value. 
Increasing: The ME performs the increasing procedure with EF AC m sending the value which has to be added. 
Accumulated Call Meter Maximum Value. 

Request: The ME performs the reading procedure with EF ACMmax . 

Initialisation: The ME performs the updating procedure with EF AC Mmax using the new initial maximum value. 
Price per Unit and Currency Table (PUCT). 

Request: The ME performs the reading procedure with EF PU ct- 

Update: The ME performs the updating procedure with EF PUCT . 

5.3.5 Capability configuration parameters 

Requirement: Service n°14 "available". 

Request: The ME performs the reading procedure with EF C cp2- 
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Update: The ME performs the updating procedure with EF CCP2 . 

Erasure: The ME sends the identification of the requested information to be erased. The content of the 

identified record in EF C cp2 is marked as "free". 

5.3.6 User controlled PLMN selector with Access Technology 

Requirement: Service n°20 "available". 

Request: The ME performs the reading procedure with EF PLMNwACT . 

Update: The ME performs the updating procedure with EF PLMNwAC t. 

5.3.7 Cell broadcast message identifier 

Requirement: Service n°15 "available". 

Request: The ME performs the reading procedure with EF CBMI . 

Update: The ME performs the updating procedure with EF CBMI . 

5.3.8 Group identifier level 1 

Requirement: Service n°17 "available". 

Request: The ME performs the reading procedure with EF GIDI . 

5.3.9 Group identifier level 2 

Requirement: Service n° 18 "available". 

Request: The ME performs the reading procedure with EF GID2 . 

5.3.10 Service provider name 

Requirement: Service n° 19 "available". 

Request: The ME performs the reading procedure with EF SP n- 

5.3.1 1 Enhanced multi level precedence and pre-emption service 

Requirement: Service n°24 "available". 

Request: The ME performs the reading procedure with EF eMLPP . 

5.3.12 Cell broadcast message identifier ranges 

Requirement: Service n°16 "available". 

Request: The ME performs the reading procedure with EF CBMIR . 

Update: The ME performs the updating procedure with EF C bmir- 

5.3.13 Short message status report 

Requirement: Service n° 11 "available". 

Request: If the status of a stored short message indicates that there is a corresponding status report, the ME 

performs the search record function with EF SMSR to identify the record containing the 
appropriatestatus report. The ME performs the reading procedure with EF SMSR . 
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Update: If a status report is received, the ME first seeks within the SMS record identifiers of EF SMSR for the 

same record number it used for the short message in EF SMS . If such a record identifier is found in 
EF SMSR , it is used for storage. If such a record identifier is not found, then the ME seeks for a free 
entry in EF SMSR for storage. If no free entry is found the ME runs the Purge procedure with 
EF SMSR . If there is still no free entry, the status report is not stored. 

If the ME found an appropriate record in EF S msr for storage, it updates the record with the status 
report setting the record identifier in EF SMSR to the appropriate record number of the short message 
in EF SMS . 

The status in EF S ms is updated accordingly by performing the update procedure with EF S ms- 

Erasure: The ME runs the update procedure with EF SMSR by at least storing '00' in the first byte of the 

record. The ME may optionally update the following bytes with 'FF'. 

Purge: The ME shall read the SMS record identifier (byte 1) of each record of EF SMSR . With each record 

the ME checks the corresponding short messages in EF SMS . If the status (byte 1) of the 
corresponding SMS is not equal 'ID' (status report requested, received and stored in EF SMSR ), the 
ME shall perform the erasure procedure with the appropriate record in EF SMSR . 

5.3.14 APN Control List 



Requirement: Service n°35 "available". 

Request: The ME performs the reading procedure with EF A cl- 

Update: The ME performs the updating procedure with EF ACL . 

Enabling: The ME activates service n°3 in EF EST (bit n°3 set to "1"). 

Disabling: The ME deactivates service n°3 in EF EST (bit n°3 set to "0"). 



When the APN Control List service is enabled, the ME shall check that the entire APN of any PDP context is listed in 
EF ACL before requesting this PDP context activation from the network. If the APN is not present in EF ACL , the ME shall 
not request the corresponding PDP context activation from the network. 

In the case that the APN Control List is enabled and no APN is indicated in the PDP context request, indicating that a 
network provided APN is to be used, then the ME shall only request the PDP context activation if "network provided 
APN" is contained within EF ACL . 

If the APN Control List service is enabled and the ME is to provide an APN as part of attach for PDN connectivity, then 
the ME shall verify that the APN value is present in the EF AC l and if it is not the ME shall not proceed with the attach 
procedure. If the APN Control List service is enabled and the ME does not indend to provide an APN as part of the 
attach for PDN connectivity and use a network provided APN, the ME shall not check if "network provided APN" is 
contained within EF ACL . 

5.3.15 Depersonalisation Control Keys 

Requirement: Service n°36 "available". 

Request: The ME performs the reading procedure with EF DC k- 

5.3.16 Co-operative Network List 

Requirement: Service n°37 "available". 

Request: The ME performs the reading procedure with EF CNL . 

5.3.17 CPBCCH information 

Requirement: Service n°39 "available". 

Request: The ME performs the reading procedure with EF C pbcch- 
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Update: The ME performs the updating procedure with EF CPBCCH . 

5.3.18 Investigation Scan 

Requirement: Service n°40 "available". 

Request: The ME performs the reading procedure with EF InvSc an- 

5.3.19 Enabled Services Table Request 

Requirement: Service n°2, 6, 34 or 35 "available". 

Request: The ME performs the reading procedure with EF EST . 

Update: The ME performs the updating procedure with EF ES t. 

5.3.20 Operator controlled PLMN selector with Access Technology 

Requirement: Service n°42 "available". 

Request: The ME performs the reading procedure with EFqplmnwact 

5.3.21 HPLMN selector with Access Technology 

Requirement: Service n°43 "available". 

Request: The ME performs the reading procedure with EFHPLMNwACT 

5.3.22 Automatic Answer on eMLPP service 

Requirement: Service n°25 "available" 

Request: The ME performs the reading procedure with EF Aae M- 

Update: The ME performs the updating procedure with EF AaeM . 

5.3.23 Network Parameter information 

Request: The ME performs the reading procedure with EF NETPAR . 

Update: The ME performs the updating procedure with EF NETPAR . 

5.3.24 PLMN network name 

Requirement: Service n°45 "available". 

Request: The ME performs the reading procedure with EF PNN . 

5.3.25 Operator PLMN List 

Requirement: Service n°46 "available". 

Request: The ME performs the reading procedure with EF pl 

5.3.26 Message Waiting Indication 

Requirement: Service n°48 "available". 

Request: The ME performs the reading procedure with EF MWIS . 
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Update: The ME performs the updating procedure with EF MWIS . 

5.3.27 Call Forwarding Indication Status 

Requirement: Service n°49 "available". 

Request: The ME performs the reading procedure with EF CF is. 

Update: The ME performs the updating procedure with EF CFIS . 

5.3.28 Service Provider Display Information 

Requirement: Service n°19 and 51 are "available". 

Request: The ME performs the reading procedure with EF S pdi- 

Update: The ME performs the updating procedure with EF SPDI . 

5.3.29 MMS Notifications 

Requirement: Service n°52 "available". 

Request: The ME sends the identification of the information to be read, then the ME performs the reading 

procedure with EF MMSN If Service n°53 is available the ME shall analyse the data of EF MMSN to 
ascertain, whether additional data is associated in EF EXT8 . If necessary, then the ME performs the 
reading procedure on EF EX i8 to assemble the complete MMS notification. 

Update: The ME analyses and assembles the MMS notification to be stored as follows: 

- if the MMS notification contains not more bytes than the maximum possible number for EF MMSN then the ME 
looks for the next available area to store the MMS notification. If such an area is available, it performs the updating 
procedure with EF MMS n- 

- if the MMS notification contains more bytes than the maximum possible number for EF MMSN then the ME seeks 
for a sufficient number of free records in EF EX i8 to store the complete MMS notification. 

- If there is not a sufficient number of EF EX T8 records marked as "free" to store the complete MMS 
notification, the procedure is aborted. 

- Otherwise, the ME performs the updating procedure and stores as many bytes as possible in EF MMS n. The 
Extension file record number of EF M msn is coded with the associated record number in the EF EXT8 . The 
remaining bytes are stored in the selected EF EXT8 record where the type of the record is then set to 
"additional data". The second byte of the EF EXT8 record is set with the number of bytes of the remaining 
additional data. It is possible, if the number of additional digits exceeds the capacity of the additional 
record, to chain another record inside the EF EXT8 by the identifier in the last byte of the record. In this case 
byte 2 of each record for additional data within the same chain indicates the number of bytes within the 
same record. 



The ME is only allowed to store extension data in unused records of EF EXT8 

If there is no available empty space in the USIM to store the MMS notification, it is up to ME 
implementation how the notification is handled. 

Erasure: The ME will select in the USIM the MMS notification to be erased. Depending on the MMI, the 

MMS notification may be read before the area is marked as "free". The memory of the USIM may 
still contain the old MMS notification until a new message is stored. If Service n°53 is available all 
associated records in EF EXT8 are then marked by the ME as "free" by setting them to 'FF'. 

5.3.30 MMS Issuer Connectivity Parameters 

Requirement: Service n°52 "available". 

Request: the ME performs the reading procedure with EF MMS icp. 
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Update: The ME performs the updating procedure with EF MMSICP 

5.3.31 MMS User Preferences 

Requirement: Service n°52 "available". 

Request: the ME performs the reading procedure with EF MMS up- 

Update: The ME performs the updating procedure with EF MMSUP 

5.3.32 MMS User Connectivity Parameters 

Requirement: Service n°52 and n°55 "available". 

Request: the ME performs the reading procedure with EF MMS ucp- 

Update: The ME performs the updating procedure with EF MMSUCP 

5.3.33 Network's indication of alerting 

Requirement: Service n°56 "available". 

Request: The ME performs the reading procedure with EF NIA . 

5.3.34 Multimedia Messages Storage 

If the terminal supports Multimedia Message Storage on the USIM, then the following procedures apply. 

As defined in TS 23.140 [38] a Multimedia Message consists of content, or multimedia objects, and headers to describe 
various properties of that content. An MM is stored in EF MMDF , a BER-TLV structured file. 

A list of multimedia messages is stored in the BER-TLV file EF MML where each data object identifies one Multimedia 
Message stored in EF MMDF 

Prerequisite: Service n°67 "available". 

Request: The ME performs the reading procedures on EF M ml to verify the presence and to get the location 

information of the targeted MM. Then the ME performs the reading procedure of the EF MM df file 
to get the MM. 

Update: The ME chooses a free identity (i.e. not listed in EF MML ) for the multimedia message and check for 

available space in the EF MMDF file. This procedure could be done for each update or once at the 
startup of the UE and after a REFRESH command involving one of the DF MULTIMEDIA files. Then 
the ME performs the following procedures: 

If there is no available empty space in the EF MMDF file to store the MM, the procedure is aborted 
and the user is notified. 

Else, the ME stores the MM in EF MMDF , then updates the information in EF MML accordingly. 

Erasure: After a successful deletion of an MM in EF MMDF the terminal updates the information in EF MML 

accordingly. 

5.3.35 Equivalent HPLMN Presentation Indication request 

Requirement: Service n°73 "available". 

Request: The ME performs the reading procedure with EF EH plmnpi- 

5.3.36 NAF Key Centre Address request 

Requirement: Service n°68 and service n°76 "available". 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



175 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Request: The ME performs the reading procedure with EF NAFKCA . 

5.3.37 Service provider name Icon 

Requirement: Service n°19 and service n°78 "available". 

Request: The ME performs the reading procedure with EF S pn and EF S pni- 

5.3.38 PLMN network name Icon 

Requirement: Service n°45 and service n°79 "available". 

Request: The ME performs the reading procedure with EF PNN and EF PNNI . 

5.3.39 ICE Information request 

The ICE information shall be accessible even when the security features of the UE or UICC have been enabled. The 
ICE access procedure is described in TS 22.030 [4]. The terminal shall discover that the ICE feature is supported by the 
ability to select one of the ICE files i.e. EF ICE DN , EF ICE FF or EF ICE graphics . 

Request: The terminal performs the read procedure with EF ICEDN and/or EF ICE FF and/or 

EF ICE graphics- 

Update: The terminal performs the update procedure with EF ICE dn and/or EF ICE FF and/or 

EFic E _g ra phi C s ■ 

Disable ICE display: The terminal performs the deactivate procedure consecutively on all the supported files 

(EF ICE DN , EF ICE FF and EF ICE graphlcs ). 

Enable ICE display: The terminal performs the activate procedure consecutively on all the supported files (EF ICEDN , 
EF ICE FF and EF ICE graphlcs ). 

The content of the EF ICE D n, EF ice ff and EF ICE grap hics shall be preserved when enabling and disabling the ICE display. 

5.3.40 eCall Related Procedures 

The eCall feature on the USIM provides two numbers, a test number and a reconfiguration number, to the terminal to be 
used with the eCall. eCall support on the USIM is indicated in the service table when service '89' is "available". 

Depending on the type of eCall support, EF FDN or EF SDN is used to provide the eCall functionality. 

5.3.40.1 eCall Only support 

Requirement: Service n° 89 and Service n° 2 are "available" and FDN service is enabled in EF ES t- 

Request: The ME performs the reading procedure with EF FDN . 

If eCall only calls are supported, then EF FDN shall only contain two entries. The first entry shall contain the eCall test 
number and the second entry shall contain the eCall reconfiguration number. A terminal in eCall only mode performs 
the FDN related procedures. 

5.3.40.2 eCall and Normal call support 

Requirement: Service n° 89 and Service n° 4 are "available". 

Request: The ME performs the reading procedure with EF S dn- 

If eCall and normal calls are supported, then the last two entries of EF SDN shall contain the eCall test number and the 
eCall reconfiguration number respectively. A terminal in eCall and normal mode performs the SDN related procedures. 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



176 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



5.3.41 SM-over-IP 

Requirement: Service n°12 and n°91 "available". 

Request: the ME performs the reading procedure with EF PSISMSC . 

Update: The ME performs the updating procedure with EF PS ismsc- 

5.3.42 U ICC access to IMS 

Requirement: Service n°95 is "available" and the ISIM application defined in TS 31.103 [64] is not present on 
the UICC. 

Request: The terminal performs the reading procedure with EF UICCIARI . 

The procedures and command for "UICC access to IMS" are defined in TS 31.111 [12]. An ME supporting UICC 
access to IMS shall perform the reading procedure with EF UIC ciari prior to sending a registration to the IMS. 

5.4 USAT related procedures 

5.4.1 Data Download via SMS-PP 

Requirement: USIM Service n°28 "available". 
The procedures and commands for Data Download via SMS-PP are defined in TS 31.1 1 1 [12]. 

5.4.2 Image Request 

The terminal sends the identification of the information to be read. The terminal shall analyse the data of EF IM g to 
identify the files containing the instances of the image. If necessary, then the terminal performs READ BINARY 
commands on these files to assemble the complete image instance data. 

5.4.3 Data Download via SMS-CB 

Requirement: USIM Service n°29 "available". 

The ME shall perform the reading procedure with EF C bmid, and add the message identifiers to the Cell Broadcast search 
list. On receiving a cell broadcast message the procedure defined in TS 31.111 [12] applies. 

5.4.4 Call Control by USIM 

Requirement: USIM Service n°30 "available". 

The procedures and commands for Call Control by USIM are defined in TS 31.1 1 1 [12]. It is mandatory for the ME to 
perform the procedures if it has indicated that it supports Call Control by USIM in the TERMINAL PROFILE 
command. 

5.4.5 MO-SMS control by USIM 

Requirement: USIM Service n°31 "available". 

The procedures and commands for MO-SMS control by USIM are defined in TS 31.111 [12]. It is mandatory for the 
ME to perform the procedures if it has indicated that it supports MO-SMS control by USIM in the TERMINAL 
PROFILE command. 

5.4.6 Data Download via USSD and USSD application mode 

Requirement: Service n°70 "available". 
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The procedures and commands for Data Download via USSD and USSD application mode are defined in 
TS 31.111 [12]. 

5.4.7 Additional TERMINAL PROFILE after UICC activation 

Requirement: USIM Service n°72 "available". 

The procedures and commands for Additional TERMINAL PROFILE after UICC activation are defined in 
TS 3 1 . 1 1 1 [12] and allow the ME to send multiple Terminal Profile downloads. 

5.4.8 Terminal Applications 

Requirement: Service n°77 "available" 
The procedures and commands for "Terminal Applications" are defined in TS 31.111 [12] 

5.4.9 Call control on EPS PDN connection by USIM 

Requirement: USIM Service n°87 "available". 
The procedures and commands for Call control on EPS PDN connection by USIM are defined in TS 31.111 [12]. 

5.4.10 Communication Control for IMS by USIM 

Requirement: USIM Service n°93 "available". 

The procedures and commands for Communication Control for IMS by USIM are defined in TS 3 1 . 1 1 1 [ 1 2] . It is 
mandatory for the ME to perform the procedures if it has indicated that it supports Communication Control for IMS by 
USIM in the TERMINAL PROFILE command. 

5.4.11 USAT Facility Control 

Requirement: The ME supports the USAT over AT feature specified in TS 3 1 . 1 1 1 [12] . 
Request: The ME performs the reading procedures of EF UFC . 

5.4.12 Extended Terminal Applications 

Requirement: Service n°77 and n°94 "available" 
The procedures and commands for "Extended Terminal Applications" are defined in TS 31.111 [12]. 

5.5 MexE related procedures 

MexE is an optional feature. The higher level procedures, and contents and coding of the commands are given in 

TS 23.057 [30]. Procedures relating to the transmission of commands and responses across the USIM/ME interface are 

given in this clause. A USIM or ME supporting MexE shall conform to the requirements given in this clause. 

5.5.1 MexE ST 

Requirement: Service n°41 (MexE) "available". 

Request: The ME performs the reading procedure with EF MeX E-sT 

5.5.2 Operator root public key 

Requirement: Service n°41 (MexE) "available" and MexE ST service n°l (EF rpk) "available". 
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Request: The ME performs the reading procedure with EF ORP k- The ME shall analyse the data of EF ORPK 

(clause 4.4.1.4.2) to identify the files containing the certificate instances. If necessary, then the ME 
performs READ BINARY commands on these files to assemble the complete certificate instance 
data. 

5.5.3 Administrator root public key 

Requirement: Service n°41 (MexE) "available" and MexE ST service n°2 (EF ARPK ) "available". 

Request: The ME performs the reading procedure with EF ARPK . The ME shall analyse the data of EF ARPK 

(clause 4.4.1.4.3) to identify the file containing the certificate instance. If necessary, then the ME 
performs READ BINARY commands on this file to assemble the complete certificate instance 
data. 

5.5.4 Third Party root public key(s) 

Requirement: Service n°41 (MexE) "available" and MexE ST service n°3 (EF TPRPK ) "available". 

Request: The ME performs the reading procedure with EF TPRPK . The ME shall analyse the data of EF TPRPK 

(clause 4.4.1.4.4) to identify the files containing the certificate instances. If necessary, then the ME 
performs READ BINARY commands on these files to assemble the complete certificate instance 
data. 

5.5.5 Trusted Key/Certificates Data Files 

Requirement: Service n°41 (MexE) "available". 

Request: The ME performs the reading procedure with EF TKC df. The ME shall analyse the data of EF TK cdf 

and, if necessary, perform READ BINARY commands on these files 

5.6 WLAN related procedures 

5.6.1 WLAN Selection related Procedures 

Requirement: service n°62 or n°63 or n°8 1 or n°82 or n°83 or n°84 or n°88 "available" 

The ME shall read the User, Home and Operator controlled WSIDs, the I-WLAN Equivalent HPLMN Presentation 
Indication, I-WLAN HPLMN Priority Indication, the I-WLAN Last Registered PLMN and the HPLMN Direct Access 
Indicationfrom the corresponding list files (i.e. EF UWS idl, EF HW sidl, EF OW sidl, EF WEHPL mnpi , EF WLRPLM n, EF WHP i and 
EF HP LMDAi)to perform WLAN selection procedures as described in TS 24.234 [40]. 

The user may change the User controlled WSIDs. 

5.6.2 WLAN PLMN Selection related procedures 

Requirement: service n°60 or n°61 "available" 

The ME shall read the User controlled PLMN selector and/or Operator controlled PLMN selector in EF PLMNWLAN and 
EFq P lmnwlan respectively for WLAN PLMN Selection procedures as described in TS 24.234 [40]. 

The user may change the User controlled PLMN selector for WLAN. 

5.6.3 WLAN access authentication related procedures 

Requirement: service n°59 "available" 

When the ME tries a full authentication, it shall inspect if a valid Pseudonym is available in EF Pseudo and use it as the 
user name portion of the NAI for WLAN access authentication following the procedures described in TS 24.234 [40]. 
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The ME shall manage pseudonyms as defined in TS 24.234 [40]. 

5.6.4 WLAN access re-authentication related procedures 

Requirement: service n°66 "available" 

When the ME tries a fast re-authentication, it shall inspect if a valid reauthentication identity is available in EF WRI and 
use it as the user name portion of the NAI for WLAN access re-authentication following the procedures described in 
TS 24.234 [40]. 

The ME shall manage re-authentiction identities, Master Key and counter values as described in TS 24.234 [40]. 

5.7 Network Connectivity Parameters for UICC IP connections related 
procedures 

The EF NCP . IP access procedures are described in ETSI TS 102 483 [50]. 

Request: The terminal performs the read procedure with EF NC p-ip before establishing a remote data link for 

UICC remote IP connectivity as described in ETSI TS 102 483 [50]. 

Refresh: The terminal performs the refresh procedure with EF NCP . IP . 

5.8 H(e)NB related procedures 

5.8.1 CSG Access Control procedures 

Requirement: Service n°86 is "available" 

Request: The terminal performs the read procedure with EF AC sgl- 

Update: The terminal performs the updating procedure with EF ACSGL 

The ME shall read the allowed CSG Ids from EF AC sgl in order to perform H(e)NB selection procedures. The lists in 
EF A csgl shall take precedence over the list stored in the ME non-volatile memory. 

Requirement: Service n°90 is "available" 

Request: The terminal performs the read procedure with with EFocsgl- 

The ME shall read the Operator CSG Ids from EFocsgl in order to perform H(e)NB selection procedures. The list in 
EFocsgl shall take precedence over the list stored in the ME non-volatile memory. 

Requirement: Service n°92 is "available" 

In case of a manual CSG cell selection, the ME shall read EF AD and CSG Lists Display Indicators from EFocsgl and 
display CSG Ids accordingly. The configuration in EFocsgl shall take precedence over the configuration stored in the 
ME non-volatile memory. 

5.8.2 CSG Type related procedures 

Requirement: Service n°86 is "available" 

Request: The terminal performs the read procedure with EF AC sgl and EF C sgt- 

Update: The terminal performs the updating procedure with EF ACS gl 

The ME shall discover the association between the selected CSG ID and a CSG Type from EF AC sgl- If this association 
exists, the provided CSG Type shall be displayed. 

Requirement: Service n°90 is "available" 

Request: The terminal performs the read procedure with EFqcsgl and EFqcsgt- 
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The ME shall discover the association between the selected CSG ID and either a CSG Type from EF ACSGL or an 
Operator CSG Type from EFqcsgl- The Operator CSG Type has precedence. 

5.8.3 HNB name display related procedures 

Requirement: Service n°86 is "available" 

Request: The terminal performs the read procedure with EF AC sgl and EF H nbn- 

Update: The terminal performs the updating procedure with EF ACSGL and EF HNBN . 

The ME shall discover the association between the selected CSG ID and a HNB name from EF AC sgl- If this association 
exists, the provided HNB name shall be displayed. 

Requirement: Service n°90 is "available" 

Request: The terminal performs the read procedure with EFqcsgl an d EF 0HNBN . 

The ME shall discover the association between the selected CSG ID and either a HNB Name from EF AC sgl or an 
Operator HNB from EFocsgl- The Operator HNB Name has precedence. If this association exists, the HNB Name shall 
be displayed. 

Requirement: Service n°92 is "available" 

In case of a manual CSG cell selection, the ME shall read EF AD and the CSG Lists Display Indicators from EFqcsgl an d 
display HNB Name accordingly. The configuration in EF 0C sgl shall take precedence over the configuration stored in the 
ME non-volatile memory. 



6 Security features 

The security aspects of 3G are specified in TS 33.102 [13] and TS 33.103 [14]. This clause gives information related to 
security features supported by the USIM to enable the following: 

- authentication of the USIM to the network; 

- authentication of the network to the USIM; 
authentication of the user to the USIM; 

- data confidentiality over the radio interface; 

- file access conditions; 

- conversion functions to derive GSM parameters. 

6.1 Authentication and key agreement procedure 

This clause gives an overview of the authentication mechanism and cipher and integrity key generation which are 
invoked by the network. For the specification of the corresponding procedures across the USIM/ME interface see 
clause 5. 

The mechanism achieves mutual authentication by the user and the network showing knowledge of a secret key K 
which is shared between and available only to the USIM and the AuC in the user's HE. In addition, the USIM and the 
HE keep track of counters SQN MS and SQN H e respectively to support network authentication. SQN H e is a counter in the 
HLR/AuC, individual for each user and SQN M s denotes the highest sequence number the USIM has ever accepted. 

When the SN/VLR initiates an authentication and key agreement, it selects the next authentication vector and sends the 
parameters RAND and AUTN (authentication token) to the user. Each authentication token consists of the following 
components: a sequence number SQN, an Authentication Management Field (AMF) and a message authentication code 
MAC over the RAND, SQN and AMF. 
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The USIM checks whether AUTN can be accepted and, if so, produces a response RES which is sent back to the 
SN/VLR. The SN/VLR compares the received RES with XRES. If they match the SN/VLR considers the authentication 
and key agreement exchange to be successfully completed. The USIM also computes CK and IK. The established keys 
CK and IK will be used by the ME to perform ciphering and integrity functions. 

A permanent secret key K is used in this procedure. This key K has a length of 128 bits and is stored within the USIM 
for use in the algorithms described below. Also more than one secret key K can be stored in the USIM. The active key 
to be used by the algorithms is signalled within the AMF field in the AUTN. 

6.2 Cryptographic Functions 

The names and parameters of the cryptographic functions supported by the USIM are defined in TS 33.102 [13]. These 
are: 

fl: a message authentication function for network authentication used to compute XMAC; 

fl*: a message authentication function for support to re-synchronisation with the property that no 

valuable information can be inferred from the function values of fl* about those of fl, f5, f5* 

and vice versa; 

f2: a message authentication function for user authentication used to compute SRES; 

f3: a key generating function to compute the cipher key CK; 

f4: a key generating function to compute the integrity key IK; 

f5: a key generating function to compute the anonymity key AK (optional); 

f5*: a key generating function to compute AK in re-synchronisation procedures with the property that 

no valuable information can be inferred from the function values of f5* about those of fl, fl*, f2, 
f5 and vice versa. 

These cryptographic functions may exist either discretely or combined within the USIM. 

6.3 GSM Conversion Functions 

To gain GSM access, the USIM provides the conversion functions c2 and c3. These functions derive the required GSM 
parameters (SRES, cipher key Kc) from available 3G parameters. 

6.4 User verification and file access conditions 

The security architecture as defined in TS 31.101 [11] applies to the USIM application with the following definitions 
and additions. 

- The USIM application shall use a global key reference as PIN and local key reference as PIN2. For access to 
DFtelecom the PIN shall be verified. Access with PIN2 is limited to the ADF(USIM). 

- The only valid values for the usage qualifier are '00' (verification requirement is not used) and '08' (user 
authentication knowledge based (PIN)) as defined in ISO/IEC 7816-4 [20]. 

Disabling of PIN2 is allowed. This is, however, not the case if PIN2 is mapped to the CHV2 of a GSM application. 



7 USIM Commands 

7.1 AUTHENTICATE 
7.1.1 Command description 

The function can be used in several different contexts: 

- a 3G security context, when 3G authentication vectors (RAND, XRES, CK, IK, AUTN) are available (i.e. the 
UE is located in the UTRAN, or in a GSM radio access network which is connected to a 3G or 3G capable 
VLR/SGSN), or 
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a GSM security context, when GSM authentication data are available only (i.e. the UE is located in the GSM 
radio access network which is connected to a non-3G capable VLR/SGSN) 

- a VGCS/VBS security context, when VGCS/VBS authentication data is available 

- a GBA_U security context, when a GBA bootstrapping procedure is requested 

- a MBMS security context, when a MBMS security procedure is requested 

- a Local Key Establishment security context, when a Local Key Establishment procedure is requested. 

The function is used in GSM or 3G security context during the procedure for authenticating the USIM to its HE and 
vice versa. In addition, a cipher key and an integrity key are calculated. For the execution of the command the USIM 
uses the subscriber authentication key K, which is stored in the USIM. 

The function is used in VGCS/VBS security context during the procedure for retrieving the VGCS/VBS Short Term 
Key (VSTK) used by the terminal in establishing VGCS/VBS calls. 

The function is used in GBA security context in two different modes: 

a) Bootstrapping Mode: during the procedure for mutual authenticating of the USIM and the Bootstrapping Server 
Function (BSF) and for deriving bootstrapped key material from the AKA run. 

b) NAF Derivation Mode: during the procedure for deriving Network Application Function (NAF) specific keys 
from previous bootstrapped key material. 

The function is used in MBMS security context in two different modes: 

a) MSK Update Mode: during the procedure for updating an MBMS Service Key (MSK). 

b) MTK Generation Mode: during the procedure for retrieving the MBMS Traffic Key (MTK) used by the terminal 
to decrypt MBMS data. 

The function is related to a particular USIM and shall not be executable unless the USIM application has been selected 
and activated, and the current directory is the USIM ADF or any subdirectory under this ADF and a successful PIN 
verification procedure has been performed (see clause 5). 

7.1.1.1 3G security context 

The USIM first computes the anonymity key AK = f5 K (RAND) and retrieves the sequence number SQN = (SQN © 
AK) © AK. 

Then the USIM computes XMAC = fl K (SQN II RAND II AMF) and compares this with the MAC which is included in 
AUTN. If they are different, the USIM abandons the function. 

Next the USIM verifies that the received sequence number SQN is previously unused. If it is unused and its value is 
lower than SQN MS , it shall still be accepted if it is among the last 32 sequence numbers generated. A possible 
verification method is described in TS 33.102 [13]. 

NOTE: This implies that the USIM has to keep a list of the last used sequence numbers and the length of the list 
is at least 32 entries. 

If the USIM detects the sequence numbers to be invalid, this is considered as a synchronisation failure and the USIM 
abandons the function. In this case the command response is AUTS, where: 
AUTS = Conc(SQNus) II MACS; 

Conc(SQN MS ) = SQN MS (D f5 * K ( RAND ) is the concealed value of the counter SQN MS in the USIM; and. 
MACS = fl *k(SQNms 1 1 RAND 1 1 AMF) where: 

RAND is the random value received in the current user authentication request; 

the AMF assumes a dummy value of all zeroes so that it does not need to be transmitted in clear in the 
resynchronisation message. 

If the sequence number is considered in the correct range, the USIM computes RES = f2 K (RAND), the cipher key 

CK = f3 K (RAND) and the integrity key IK = f4 K (RAND) and includes these in the command response. Note that if this 

is more efficient, RES, CK and IK could also be computed earlier at any time after receiving RAND. 
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The use of AMF is HE specific and while processing the command, the content of the AMF has to be interpreted in the 
appropriate manner. The AMF may e.g. be used for support of multiple algorithms or keys or for changing the size of 
lists, see TS 33.102 [13]. 

If Service n°27 is "available", the USIM calculates the GSM response parameter K c , using the conversion function 
defined in TS 33.102 [13]. 

Input: 

- RAND, AUTN (AUTN:= SQN © AK II AMF II MAC). 
Output: 

- RES, CK, IK if Service n°27 is "not available". 
Or 

- RES, CK, IK, K c if Service n°27 is "available". 
Or 

- AUTS. 

7.1 .1 .2 GSM security context 

USIM operation in an GSM security context is supported if Service n°38 is "available". 

The USIM computes RES = f2 K (RAND), the cipher key CK = D K (RAND) and the integrity key IK = f4 K (RAND). 
Next the USIM calculates the GSM response parameters SRES and K c , using the conversion functions defined in 
TS 33.102 [13]. 

Input: 

- RAND. 
Output: 

- SRES; K c . 

7.1 .1 .3 VGCS/VBS security context 

USIM operation in a VGCS/VBS security context is supported if both Service n°57 and Service n°64 are 'available' 
(VGCS security context) or if both Service n°58 and Service n°65 are "available" (VBS security context). 

The USIM computes the Short Term Key (VSTK) associated with a particular VGCS/VBS Group Identifier 
(Group_Id). For this computation, the USIM uses the Voice Group (for VGCS) or Broadcast Group (for VBS) Key 
(V_Ki) identified by their respective Groupjd and Master Group Key Identifier (VK_Id). The USIM retrieves the 
Group_Id and the service flag (VGCS or VBS) from the received Voice Service Identifier (Vservice_Id). 

NOTE: The Groupjd has a variable length according to TS 43.068 [46]. 

The USIM shall first search if the Groupjd corresponds to a stored VGCS Group Identifier in EF V gcs or a stored VBS 
Group Identifier in EF V bs- 

Then, the USIM shall retrieve the V_Ki corresponding to the given Groupjd and VKJd. 

Then the USIM uses V JCi and VSTK_RAND as input parameters for the A8 _V key derivation function (as defined in 
TS 43.020 [44]) in order to compute and returns VSTK. 

Input: 

- Vservicejd, VKJd, VSTKJ^AND 
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Output: 
- VSTK. 

7.1 .1 .4 GBA security context (Bootstrapping Mode) 

USIM operations in GBA security context are supported if service n°68 is "available". 

The USIM receives the RAND and AUTN*. The USIM first computes the anonymity key AK = f5 K (RAND) and 
retrieves the sequence number SQN = (SQN © AK) © AK. 

The USIM calculates IK = f4 K (RAND) and MAC (by performing the MAC modification function described in 
TS 33.220 [42]). Then the USIM computes XMAC = fl K (SQN II RAND II AMF) and compares this with the MAC 
previously produced. If they are different, the USIM abandons the function. 

Then the USIM performs the checking of AUTN* as in UMTS security context. If the USIM detects the sequence 
numbers to be invalid, this is considered as a synchronisation failure and the USIM abandons the function. In this case 
the command response is AUTS, which is computed as in UMTS security context. 

If the sequence number is considered in the correct range, the USIM computes RES = f2 K (RAND) and the cipher key 
CK = f3 K (RAND). 

The USIM then derives and stores GBA_U bootstrapped key material from CK, IK values. The USIM shall also stores 
RAND in the RAND field of EF GBA bp 

The USIM stores GBA_U bootstrapped key material from only one bootstrapping procedure. The previous bootstrapped 
key material, if present, shall be replaced by the new one. This key material is linked with the data contained in EF GBABP 
: RAND, which is updated by the USIM and B-TID, which shall be further updated by the ME. 

NOTE: According to TS 33.220 [42], NAF-specific keys that may be stored on the USIM are not affected by this 
bootstrapping operation. 

RES is included in the command response after flipping the least significant bit. 

Input: 

- RAND, AUTN* 
Output: 

- RES 
or 

- AUTS 



7.1 .1 .5 GBA security context (NAF Derivation Mode) 

USIM operations in GBA security context are supported if service n°68 is "available". 
The USIM receives the NAF_ID and IMPI. 

The USIM performs Ks_ext_NAF and Ks_int_NAF derivation as defined in TS 33.220 [42] using the key material from 
the previous GBA_U bootstrapping procedure. 

If no key material is available this is considered as a GBA Bootstrapping failure and the USIM abandons the function. 
The status word "6985" (Conditions of use not satisfied) is returned. 

Otherwise, the USIM stores Ks_int_NAF and associated B-TID together with NAF_ID. The Ks_int_NAF keys related 
to other NAF_Ids, which are already stored in the USIM, shall not be affected. The USIM updates EF GB anl as follows: 

- If a record with the given NAF_ID already exists, the USIM updates the B-TID field of this record with the B- 
TID value associated to the GBA_U bootstrapped key involved in this GBA_U NAF derivation procedure. 
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If a record with the given NAF_ID does not exist, the USIM uses an empty record to store the NAF_ID and the 
B-TID value associated to the GBA_U bootstrapped key involved in this GBA_U NAF Derivation procedure. 

NOTE: According to TS 33.220 [42], the USIM can contain several Ks_int_NAF together with the associated B- 
TID and NAF_ID, but there is at most one pair of Ks_int_NAF and associated B-TID stored per NAF_ID. 

- In case no empty record is available the USIM shall overwrite an existing record to store the NAF_ID and the B- 
TID value associated to the GBA_U bootstrapped key involved in this GBA_U NAF Derivation procedure. To 
determine the record to overwrite, the USIM shall construct a list of record numbers by storing in the list first 
position the record number of the last used (i.e. involved in an Authentication command) or derived Ks_int_NAF 
and by shifting down the remaining list elements. The last record number in this list corresponds to the record to 
overwrite when the USIM runs out of free records. If an existing record corresponding to a Ks_int_NAF key in 
use is overwritten, the application Ks_int_NAF shall not be affected (e.g. in case a Ks_int_NAF was put into use 
as an MBMS MUK key, the MUK key shall continue to be available for the MBMS application). 

Then, the USIM returns Ks_ext_NAF. 

Input: 

- NAF_ID, IMPI 
Output: 

- Ks_ext_NAF 

7.1 .1 .6 MBMS security context (MSK Update Mode) 

USIM operations in MBMS security context are supported if service n°69 is "available". 

The USIM receives the MIKEY packet containing an MSK update message. First, the USIM uses the MUK ID to 
identify the Ks_int_NAF corresponding with a previous bootstrapping procedure. 

The USIM shall check if a new NAF derivation procedure involving the received Idi in the MIKEY message has been 
performed or if it is the first time that this Idi is used. If this check cannot be performed because the corresponding 
Ks_int_NAF key was overwritten, the USIM abandons the function and returns the status word '6985' (Conditions of 
use not satisfied). In case of a new NAF derivation procedure or a new Idi, the USIM shall store the last bootstrapped 
Ks_int_NAF as the last generated MUK and update EF MUK as follows: 

If a record with the received Idi (included in the MUK ID: see TS 33.246 [43]) value is already present, then the 
MUK ID is stored in the corresponding field of this record, and the associated Time Stamp Counter (TS) field is 
reset. Additionally, the USIM internally stores the last successfully used MUK (i.e. MUK that was used during 
the last successful MSK update procedure), along with its MUK ID for further use (e.g. to detect Key freshness 
failure). 

- If a record with the received Idi does not exist, the USIM uses an empty record to include the MUK ID, and reset 
the associated TS field. 

- In case there is no empty record available in EF MUK the USIM abandons the function and the status word '9867' 
(Authentication error, no available memory space in EF MUK ) is returned. 

NOTE: In case no empty record in EF MUK is available the ME should run a MUK Deletion Mode procedure to 
free entries in EF MUK before running an MSK Update Mode procedure that involves a new MUK key. 

NOTE: In case the ME receives the status word '6985', the ME should derive the required Ks_int_NAF key. In 
case the corresponding bootstrapping key Ks is still available, the ME should invoke the Authenticate 
command in "GBA - NAF derivation Mode" before invoking again the AUTHENTICATE command in 
"MBMS - MSK Update Mode". In case the corresponding bootstrapping key has been updated, the ME 
should put the new B-TID into use. 

If the received MUK ID does not correspond to the last generated MUK (i.e. last bootstrapped MUK) then the USIM 
proceeds as follows: 

If the received MUK ID corresponds to the last successfully used MUK then the USIM uses this MUK to verify 
the integrity of the message. If the verification is unsuccessful, the USIM abandons the function and returns the 
status word '9862' (Authentication error, incorrect MAC). If the verification is successful, the USIM abandons 
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the function and returns the status word '9865' (Key Freshness Failure), indicating to the ME that the received 
MIKEY message is protected using the last successfully used MUK that does not correspond to the last 
generated MUK (the new B-TID shall be put into use: see TS 33.246 [43]). In this case, the USIM shall not 
return a MIKEY verification message. 

Otherwise, this is considered as a bootstrapping failure (incorrect MUK) and the USIM abandons the function. 
The status word "6A88" (Referenced data not found) is returned. 

Otherwise, if the received MUK ID corresponds to the last generated MUK, the USIM uses the MUK value for MSK 
validation and derivation functions as described in TS 33.246 [43]. If the validation is unsuccessful, the status word 
'9862' (Authentication error, incorrect MAC) is returned and the USIM abandons the function. 

After a successful MSK Update procedure the USIM stores the received credentials (e.g. MSK and/or Key Validity 
data) and updates EF MSK as follows: 

If a record with the received Key Domain ID and Key Group part (i.e. Key Group part of the MSK ID) already 
exists, USIM stores the older MSK ID (if any) and its associated TS as the 2 nd MSK ID and TS. The newer MSK 
ID is stored as the 1 st MSK ID. In case the received MSK message has the same MSK ID as a stored MSK, the 
TS associated to this stored MSK is stored as the 1 st TS. Otherwise, the 1 st TS value is reset. The number of 
stored MSK IDs and corresponding TS shall be set to '02' if the USIM stores two different MSK IDs. The USIM 
shall not store two MSK IDs with the same Key Number part in the same record. 

- If a record with the received Key Domain ID and Key Group part does not exist, the USIM uses an empty record 
to include those values. The received MSK ID is stored as the 1 st MSK ID and the associated TS is reset. The 2 nd 
MSK ID and the associated TS are set to 'FF FF'. The number of stored MSK IDs and corresponding TS shall be 
set to '01'. In case there is no empty record available in EF MSK the USIM abandons the function and the status 
word '9866' (Authentication error, no available memory space) is returned. 

- In the case of a BM-SC solicited pull procedure (i.e. when the Key Number part of the MSK ID is set to 0x0), 
EFmsk is not updated. 

NOTE: In case no empty record is available the ME should run an MSK Deletion Mode procedure to free entries 
in EF M sk before running an MSK Update Mode procedure that contains a new MSK key. 

Then, the USIM stores the Time Stamp field (retrieved from the MIKEY message) in its corresponding field under 
EFmuk- 

The USIM stores internally the last successfully used MUK along with its MUK ID for further use. This MUK may be 
used beyond its GBA validity (i.e. after the derivation of a new Ks_int_NAF resulting from a new bootstrap procedure) 
to verify the integrity of a MIKEY message in order to detect a synchronization failure. This may occur if the last 
derived Ks_int_NAF did not reach the BM-SC. 

The MSK is not necessarily updated in the MIKEY message, since a MSK transport message can be sent e.g. to update 
the Key Validity data or as part of a BM-SC solicited pull procedure. In such a case the USIM shall use the status word 
'9000' to inform the ME that the MIKEY message validation using the last generated MUK has succeeded. 

Finally, if the V-bit in the HDR field of the received MIKEY message is set then the USIM shall produce a MSK 
Verification Message as described in TS 33.246 [43]. In this case the command response is the MIKEY verification 
message. 

Input: 

- MIKEY message 
Output: 

MIKEY message 

or 

- None 
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7.1.1.7 Void 

7.1 .1 .8 MBMS security context (MTK Generation Mode) 

USIM operations in MBMS security context are supported if service n°69 is "available". 

The USIM receives the MIKEY message containing an MBMS MTK and a Salt key (if Salt key is available). First, the 
USIM retrieves the MSK with the Key Domain ID and the MSK ID given by the Extension payload of the MIKEY 
message (as described in TS 33.246 [43]). 

If the needed MSK does not exist, this is considered as a MSK failure and the USIM abandons the function. The status 
word '6A88' (Referenced data not found) is returned. 

If the key validity data of the MSK indicates an invalidated MSK (i.e. SEQ1 is greater than SEQu) then the USIM 
returns the status word '6985' (Conditions of use not satisfied) and abandons the function. SEQ1 and SEQu are defined 
in TS 33.246 [43]. 

Otherwise, the USIM performs the MBMS Generation and Validation Function (MGV-F) as described in 
TS 33.246 [43] using MSK. 

If the USIM detects that the given MTK ID is invalid, this is considered as a SEQp freshness failure and the USIM 
abandons the function. The status word '9865' (Key freshness failure) is returned. 

If the integrity validation of the MIKEY message is unsuccessful, the USIM abandons the function and returns the 
status word '9862' (Authentication error, incorrect MAC). 

After successful MGV_F procedure the USIM stores the Time Stamp field (retrieved from the MIKEY message) as the 
Time Stamp Counter (TS) associated with the involved MSK under EF M sk 

The USIM also stores MTK ID (retrieved from the MIKEY message) as the SEQ1 associated with MSK. 
Then, the USIM returns MTK and Salt key (if Salt key is available). 
Input: 

- MIKEY message 
Output: 

- MTK and Salt (if available). 

7.1 .1 .9 MBMS security context (MSK Deletion Mode) 

USIM operations in MBMS security context are supported if service n°69 is "available". 

The USIM receives the Key Domain ID and the Key Group part of the MSK ID. The USIM shall identify in the EF MSK 
the record containing MSK IDs having this Key Domain ID and Key Group part. 

If no record is identified, the USIM abandons the function and returns the status word '6A88' (Referenced data not 
found). 

If a record is found, the USIM shall delete all corresponding MSKs and set to 'FF' the bytes of this record. 
Input: 

- Key Domain ID, MSK ID Key Group part 
Output: 

- None. 

7.1 .1 .1 MBMS security context (MUK Deletion Mode) 

USIM operations in MBMS security context are supported if service n°69 is "available". 
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The USIM shall identify in EF MUK the record containing the received MUK ID. 

If no record is identified, the USIM abandons the function and returns the status word '6A88' (Referenced data not 
found). 

If a record is found, the USIM shall delete the corresponding MUK and set to 'FF' the bytes of this record. If a 
corresponding Ks_int_NAF key is present (i.e. with the same NAF_ID), it shall be deleted and its corresponding record 
in EF GBANL shall be set to 'FF'. In case the corresponding Ks key is present (i.e. with the same B-TID), it shall be deleted 
and the content of EF GB abp shall be set to FF'. 

Input: 

MUK ID TLV 
Output: 
- None 

7.1 .1 .1 1 Local Key Establishment security context (Key Derivation mode) 

USIM operations in this security context are supported if service n°68 and service n°76 are "available". 

The USIM receives the NAF_ID corresponding to the NAF Key Centre, the Terminal_ID, the Terminal_appli_ID, the 
UICC_appli_ID, RANDx, the Counter Limit value and the MAC as described in TS 33. 1 10 [47]. 

The USIM uses the NAF_ID to identify the Ks_int_NAF associated to the NAF Key Centre. If no valid Ks_int_NAF is 
available, this is considered as a Key Establishment failure and the USIM abandons the function. The status word 
'6A88' (Referenced data not found) is returned. 

If the Ksjocal key derivation is not authorized by the local UICC policy (e.g. Terminal_appli_ID/UICC_appli_ID 
association not authorized or Terminal_ID value not authorized), the USIM abandons the function. The status word 
'6985' (Conditions of use not satisfied) is returned. 

Otherwise, the USIM retrieves the appropriate Ks_int_NAF, derives Ksjocal as described in TS 33.110 [47]. The 
USIM verifies the MAC value received from the Terminal as described in TS 33.1 10 [47]: 

- If the verification is unsuccessful, the USIM abandons the function and returns the status word '9862' 
(Authentication error, incorrect MAC). 

- If the verification is successful, the USIM stores Ks_local and associated parameters Terminal_ID, 
Terminal_appli_ID, UICC_appli_ID, RANDx and the Ksjocal Counter Limit. The USIM returns the Local Key 
Establishment Operation Response TLV (indicating a successful Key Derivation operation) and a response 
MAC, which is derived as described in TS 33.1 10 [47]. 

The minimum number of Local keys that can be stored by the USIM shall be defined by the service provider at the pre- 
issuance of the card. 

In case the maximum number of Local Key was already reached or there is not enough available memory in the USIM, 
the USIM shall overwrite a Local Key and its associated data in order to store the new one. To determine the Ksjocal 
to overwrite, the USIM shall construct a list of Ksjocal identifiers by storing in the list first position the Ksjocal 
identifier of the last used or derived Ksjocal and by shifting down the remaining list elements. The last Ksjocal 
identifier in this list corresponds to the Ksjocal to overwrite when the USIM runs out of free memory or when the 
maximum number of Ksjocal keys is reached. If an existing Ksjocal in use is overwritten, the application using 
Ksjocal shall not be affected. 

Input: 

- Local Key Establishment Mode (Key Derivation mode), Counter Limit, request MAC, Key Identifier (i.e. 
NAFJD, Terminal JD, Terminal_appliJD, UICC_appli JD, RANDx) 

Output: 

- Key Derivation operation status, response MAC. 
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7.1 .1 .1 2 Local Key Establishment security context (Key Availability Check mode) 

USIM operations in this security context are supported if service n°68 and service n°76 are "available". 

The USIM receives a Ks_local identifier. The USIM checks if a corresponding valid Ks_local is available. If a valid 
Ks_local key is available the Local Key Establishment Operation Response TLV (indicating a successful Key 
Availability Check operation) is returned. In case no valid Ks_local key is available the command fails and the status 
word '6A88' (Referenced data not found) is returned. 

Input: 

Local Key Establishment Mode (Key Availability Check mode), Key identifier (i.e. NAF_ID, Terminal_ID, 
Terminal_appli_ID, UICC_appli_ID, RANDx). 

Output: 

- Key Availability Check Operation Status. 

7.1 .2 Command parameters and data 

This command can be used with an EVEN or an ODD instruction (INS) code. The EVEN instruction code can be used 
when the challenge data provided by the terminal is not TLV encapsulated data and the length of the challenge data 
provided by the terminal is less than 256 bytes. 

The ODD instruction code shall be used with the security context specified in table 2, when challenge and response data 
is TLV encapsulated regardless of their length. Terminals and UICCs that do not support security context requiring 
TLV format (e.g. MBMS), do not have to support AUTHENTICATE command with ODD instruction code. 

EVEN INS code 



Code 


Value 


CLA 


As specified in TS 31.101 [11] 


INS 


'88' 


P1 


'00' 


P2 


See table 1 below 


Lc 


See below 


Data 


See below 


Le 


'00', or maximum length of data expected in 
response 



Parameter P2 specifies the authentication context as follows: 



Table 1 : Coding of the reference control P2 



Coding 
b8-b1 


Meaning 


'1 ' 


Specific reference data (e.g. DF 
specific/application dependant key) 


1 XXX' 


Authentication context: 

000 GSM context 

001 3G context 

010 VGCS/VBS context 
1 00 GBA context 



All other codings are RFU. 
ODD INS code 

The authentication data and the authentication response data are encapsulated in BER-TLV objects structured using tag 
73' for BER-TLV structured data and tag '53' otherwise. 

How this command can chain successive blocks of authentication data, or authentication response data is described in 
TS 31 101 [11]. 
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If PI indicates "First block of authentication data" or "Next block of authentication data": 
Input: 

- Authentication data encapsulated in a BER-TLV data object. 
Output: 

- None. 



Code 


Value 


CLA 


As specified in TS 31.101 [11] 


INS 


'89' 


P1 


As specified in TS 31.101 [11] 


P2 


See table 2 below 


Lc 


Length of the subsequent data field 


Data 


Authentication related data 


Le 


Not present 



If PI indicates "First block of authentication response data" or "Next block of authentication response data": 
Input: 

- None. 
Output: 

- Authentication response data encapsulated in a BER-TLV data object. 



Code 


Value 


CLA 


As specified in TS 31.101 [11] 


INS 


'89' 


P1 


As specified in TS 31.101 [11] 


P2 


See table 2 below 


Lc 


Not present 


Data 


Not present 


Le 


Length of the response data 



Parameter PI is used to control the data exchange between the terminal and the UICC as defined in TS 31.101 [11]. 
Parameter P2 specifies the authentication context as follows: 



Table 2: Coding of the reference control P2 



Coding 
b8-b1 


Meaning 


'1 ' 


Specific reference data (e.g. DF specific/application dependant key) 


' XXX' 


Authentication context: 

101 MBMS context 

110 Local Key Establishment mode 



All other codings are RFU. 
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Byte(s) 


Description 


Length 


1 


Length of RAND (L1) 


1 


2 to (L1+1) 


RAND 


L1 


(L1+2) 


Length of AUTN (L2) (see note) 


1 


(L1+3) to 
(L1+L2+2) 


AUTN (see note) 


L2 


Note: Parameter present if and only if in 3G security context. 



The coding of AUTN is described in TS 33.102 [13]. The most significant bit of RAND is coded on bit 8 of byte 2. The 
most significant bit of AUTN is coded on bit 8 of byte (Ll+3). 

Response parameters/data, case 1, 3G security context, command successful: 



Byte(s) 


Description 


Length 


1 


"Successful 3G authentication" tag = 'DB' 


1 


2 


Length of RES (L3) 


1 


3 to (L3+2) 


RES 


L3 


(L3+3) 


Length of CK (L4) 


1 


(L3+4) to 
(L3+L4+3) 


CK 


L4 


(L3+L4+4) 


Length of IK (L5) 


1 


(L3+L4+5) to 
(L3+L4+L5+4) 


IK 


L5 


(L3+L4+L5+5) 


Length of K c (= 8) (see note) 


1 


(L3+L4+L5+6 
to 

(L3+L4+L5+13) 


K c (see note) 


8 






Note: Parameter present if and only if Service n°27 is "available". 



The most significant bit of RES is coded on bit 8 of byte 3. The most significant bit of CK is coded on bit 8 of byte 
(L3+4). The most significant bit of IK is coded on bit 8 of byte (L3+L4+5). 

Response parameters/data, case 2, 3G security context, synchronisation failure: 



Byte(s) 


Description 


Length 


1 


"Synchronisation failure" tag = 'DC' 


1 


2 


Length of AUTS (L1) 


1 


3 to (L1+2) 


AUTS 


L1 



The coding of AUTS is described in TS 33.102 [13]. The most significant bit of AUTS is coded on bit 8 of byte 3. 
Response parameters/data, case 3, GSM security context, command successful: 



Byte(s) 


Description 


Length 


1 


Length of SRES (= 4) 


1 


2 to 5 


SRES 


4 


6 


Length of K c (= 8) 


1 


7 to 14 


Kc 


8 



The most significant bit of SRES is coded on bit 8 of byte 2. The most significant bit of Kc is coded on bit 8 of byte 7. 

7.1 .2.2 VGCS/VBS security context 



Byte(s) 


Description 


Length 


1 


Length of Vservicejd 


1 


2 to 5 


Vservicejd 


4 
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6 


Length of VKJd 


1 


7 


VK Id 


1 


8 


Length of VSTKRAND (L1) 


1 


9 to Ll+8 


VSTKRAND 


LI 



Vservice_Id is coded in the same way as the octets 2-5 in the Descriptive group or broadcast call reference information 
element as defined in TS 24.008 [9]. 

An Example for the coding of Vservice Jd can be found in Annex K. 
The coding of VKJd is as follows: 



Coding of VKJd 



Coding 
b8-b1 


Meaning 


'00000001' 


Corresponds to the 1 st group key 


'00000010' 


Corresponds to the 2 na group key 



The coding of VSTKJRAND is described in TS 43.020 [44]. The VSTKJRAND shall be inserted left-aligned into the 
LI bytes, with unused bits to the right set to zero. 

Response parameters/data, VGCS/VBS security context, command successful: 



Byte(s) 


Description 


Length 


1 


"Successful VGCS/VBS operation" tag = 'DB' 


1 


2 


Length of VSTK(16) 


1 


3 to 18 


VSTK 


16 



7.1 .2.3 GBA security context (Bootstrapping Mode) 



Byte(s) 


Description 


Length 


1 


'GBA Security Context Bootstrapping Mode' tag = "DD" 


1 


2 


Length of RAND (L1) 


1 


3 to (L1+2) 


RAND 


L1 


(L1+3) 


Length of AUTN (L2) 


1 


(L1+4) to 


AUTN 


L2 


(L1+L2+3) 







Response parameters/data, GBA security context (Bootstrapping Mode), synchronisation failure: 



Byte(s) 


Description 


Length 


1 


"Synchronisation failure" tag = 'DC 


1 


2 


Length of AUTS (L1) 


1 


3 to (L1+2) 


AUTS 


L1 



AUTS coded as for UMTS Security context. 

Response parameters/data, GBA security context (Bootstrapping Mode), command successful: 



Byte(s) 


Description 


Length 


1 


"Successful GBA operation" tag = 'DB' 


1 


2 


Length of RES (L) 


1 


3 to (L+2) 


RES 


L 



RES coded as for UMTS Security context. 
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7.1 .2.4 GBA security context (NAF Derivation Mode) 



Byte(s) 


Description 


Length 


1 


'GBA Security Context NAF Derivation Mode' tag = "DE" 


1 


2 


Length of NAF ID (L1 ) 


1 


3 to (L1+2) 


NAF ID 


L1 


(L1+3) 


Length of IMPI (L2) 


1 


(L1+4) to 


IMPI 


L2 


(L1+L2+3) 







Response parameters/data, GBA security context (NAF Derivation Mode), command successful: 



Byte(s) 


Description 


Length 


1 


"Successful GBA operation" tag = 'DB' 


1 


2 


Length of Ks_ext_NAF (L) 


1 


3 to (L+2) 


Ks_ext_NAF 


L 



Coding of Ks_ext_NAF as described in TS 33.220 [42]. 



7.1 .2.5 MBMS security context (All Modes) 



Byte(s) 


Description 


Coding 


Length 


1 


MBMS Data Object tag ("53") 


As defined in TS 31.101 [11] for 
BER-TLV data object 


1 


2 to 1+A bytes (A<4) 


MBMS Data Object length (L1) 


As defined in TS 31.101 [11] for 
BER-TLV data object 


A 


A+2 


MBMS Security Context Mode 


See below 


1 


A+3 to (A+L1+1) 


MIKEY message or Key Domain ID | 
MSK ID Key Group part or MUK ID TLV 




L1-1 



Only the MIKEY message shall be transmitted in the MBMS security context mode '01' or '02'. 

Only the Key Domain ID (coded on 3 bytes as described in TS 33.246 [43]) concatenated with the Key Group part of 
the MSK ID (coded on two bytes as described in TS 33.246 [43] where the last transmitted byte represents the least 
significant byte of the Key Group part) shall be transmitted in the MBMS security context mode '03'. 

Only the MUK ID TLV shall be transmitted in the MBMS security context mode '04'. The MUK ID TLV, containing 
the MUK Idr and MUK Idi only, shall be encoded as described in clause 4.2.81. 

Parameter MBMS Security Context Mode specifies the MBMS mode in which MBMS security procedure is performed 
as follows: 



Coding of MBMS Security Context Mode 



Coding 


Meaning 


'01' 


MSK Update Mode 


"02' 


MTK Generation Mode 


'03' 


MSK Deletion Mode 


'04' 


MUK Deletion Mode 



Response parameters/data, MBMS security context (MSK Update Mode), command successful: 



Byte(s) 


Description 


Coding 


Length 


1 


MBMS operation response Data Object tag 
("53") 


As defined in TS 31.101 [11] for 
BER-TLV data object 


1 


2 to 1+A bytes (A<4) 


MBMS operation response Data Object length 
(L) 


As defined in TS 31.101 [11] for 
BER-TLV data object 


A 


A+2 


"Successful MBMS operation" tag = 'DB' (see 
note 1 ) 




1 


A+3 to (A+L+1) 


MIKEY message (see note 1) 




L-1 


NOTE 1 : Parameter present if a MIKEY verification message is returned. Otherwise, the USIM returns "53 01 DB" 
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Response parameters/data, MBMS security context (MTK Generation Mode), command successful: 



Byte(s) 


Description 


Coding 


Length 


1 


MBMS operation response Data Object tag 
("53") 


As defined in TS 31.101 [11] for 
BER-TLV data object 


1 


2 to 1+A bytes (As 4) 


MBMS operation response Data Object length 
(L) 


As defined in TS 31.101 [11] for 
BER-TLV data object 


A 


A+2 


"Successful MBMS operation" tag = 'DB' 




1 


A+3 to (A+L+1) 


MTK || Salt (if Salt key is available) 




L-1 



Response parameters/data, MBMS security context (MSK and MUK Deletion Mode), command successful: 



Byte(s) 


Description 


Coding 


Length 


1 


MBMS operation response Data Object tag 
("53") 


As defined in TS 31.101 [11] for 
BER-TLV data object 


1 


2 


MBMS operation response Data Object length 


As defined in TS 31.101 [11] for 
BER-TLV data object 


1 


3 


"Successful MBMS operation" tag = 'DB' 




1 



The coding of parameters is described in TS 33.246 [43]. 

Note: The constructed TLV tag value 'AE' is used by OMA BCAST Smart Card Profile [49] for the encapsulation 
of command and response parameters/data. 



7.1 .2.6 Local Key Establishment security context (All Modes) 

The Local Key Establishment Control TLV is included in the command data to indicate the security context mode. The 
Local Key Establishment Control TLV is also included in the response data to indicate the operation status. 



Table 3: Coding of the Local Key Establishment Control TLV 



Tag Value 


Length 


Value / Meaning 


'80' 


Coded according to 
ISO/IEC 8825-1 [35] 


Local Key Establishment context: 
'01': Key Derivation mode 
'02': Key Availability Check mode 

Operation Status: 

'DB': Successful Operation 



7.1 .2.6.1 Local Key Establishment security context (Key Derivation mode) 

Command parameters/data: 



Byte(s) 


Description 


Coding 


Length 


1 


Key Derivation Data Object tag ("73") 


As defined in TS 31.101 [11] for 
BER-TLV data object 


1 


2 to A+1 bytes (A < 4) 


Key Derivation Data Object length (L) 


As defined in TS 31.101 [11] for 
BER-TLV data object 


A 


A+2 to (A+L+1) 


Key Derivation Data Object 




L 



- Key Derivation Data Object content: The TLVs defined in table 4 are included in the Key Derivation Data 
Object. 
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Table 4: Coding of the Key Derivation Data Object 



Description 


Value 


M/O 


Length (bytes) 


Local Key Establishment Control 


Coded as defined in 


M 


B 


XI \/ 

I LV 


SGCtion i a .d.o. I ne 








valuG field shall be SGt 








io in 






oounter Limn lag 




IV /I 

IVI 


H 
1 


1 /"^ fc^ /~i 4" r~l 

i_engin 


p 


IV /I 
IVI 


Note 1 


L/OUniGr LimiT 


Coded as defined in 


IV /I 
M 


p 




TQ 1 1 n M "71 

1 O OO. 1 1 U [H 1 J 






D/~»/~*i mrt l\ A A P ton 

Request iviao lag 


•GO' 


IV /I 
IVI 


1 


Length 


U 


IV /I 
M 


Note 1 


nequest mao 


Coded as defined in 


\A 

M 


u (see Note o) 




TO OO 1 i A \A 71 
1 O OO. 1 1 U [*+ / J 






Key Identitier tag 


1 Af*V 

AU 


iv/i 
IVI 


1 


Length 


t (see Note d) 


IV VI 
IVI 


Note i 


mac intin 

NAr_iu tag 


IQO' 

OO 


KA 

IVI 


1 


Length 


r 


M 


Note 1 


NAFJD 


Coded as defined in 


M 


r 




TC O.O OOC\ \AO~\ 






i ermmai iu tag 


o4 


IV/I 
IVI 


H 

1 


Length 


p 


KA 

M 


Note 1 


Terminal ID 


Coded as defined in 


IV/I 

IVI 


p 




XC O O 1 1 A M 71 
1 O OO.l 1U |4/J 






— ; : 

Terminal appli ID tag 


'PC' 

L oO 


iv/i 
IVI 


H 
\ 


Lengtn 


u 
n 


IVI 


Note i 


Terminal_appli_ID 


Coded as defined in 


mi 
M 


u 
n 


XC OO 1 1f| M 71 

1 oo.l 1U |4/J 






UICC_appli_ID tag 


'86' 


IVI 


I 


Length 


L 1 


M 


Note 1 


UICC_appliJD 


Coded as defined in 


M 


I 




TS 33.1 10 [47] 






RANDx tag 


'87' 


M 


1 


Length 


J 


M 


Note 1 


RANDx 


Coded as defined in 


M 


J (see Note 4) 




TS 33.1 10 [47] 






Note 1 : The length is coded according to ISO/IEC 8825-1 [35 






Note 2: The Key Identifier TLV is a constructed TLV containing the following primitive 


TLVs: NAFJD, TerminalJD, Terminal_appli_ID, UICC_appli_ID and RANDx. E 


is the length of the constructed Key Identifier value. 






Note 3: The most significant bit of the request MAC is coded on bit 8 of the first byte 


following the MAC Length. 








Note 4: The most significant bit of the RANDx is coded on bit 8 of the first byte following 


the RANDx Length. 









Response parameters/data, Local Key Establishment security context (Key Derivation mode), command successful: 



Byte(s) 


Description 


Coding 


Length 


1 


Key Derivation Operation Response Data 
Object tag ("73") 


As defined in TS 31.101 [11] for 
BER-TLV data object 


1 


2toA1+1 bytes (A1 < 4) 


Key Derivation Operation Response Data 
Object length (L1) 


As defined in TS 31.101 [11] for 
BER-TLV data object 


A1 


A1+2 to (A1+L1+1) 


Key Derivation Operation Response Data 
Object 




L1 



Key Derivation Operation Response Data Object content: The TLVs defined in table 5 are included in the Key 
Derivation Operation Response Data Object. 
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Table 5: Coding of the Key Derivation Operation Response Data Object 



Description 


Value 


M/O 


Length (bytes) 


Local Key Establishment Control 


Coded as defined in 


M 


B 


TLV 


section 7.1.2.6. The 
value field shall be 
set to 'DB' 






Response MAC tag 


'82' 


M 


1 


Length 


C 


M 


Note 1 


Response MAC 


Coded as defined in 
TS 33.1 10 [47] 


M 


C (see Note 2) 


Note 1 : The length is coded according to ISO/IEC 8825-1 [35]. 
Note 2: The most significant bit of the response MAC is coded on bit 8 of the first byte 
following the MAC length. 



7.1 .2.6.2 Local Key Establishment security context (Key Availability Check mode) 

Command parameters/data: 



Byte(s) 


Description 


Coding 


Length 


1 


Key Availability Check Data Object tag 
("73") 


As defined in TS 31.101 [11] for 
BER-TLV data object 


1 


2 to 1+A bytes (A<4) 


Key Availability Check Data Object 
length (L) 


As defined in TS 31.101 [11] for 
BER-TLV data object 


A 


A+2 to (A+L+1) 


Key Availability Check Data Object 




L 



- Key Availability Check Data Object content: The TLVs defined in table 6 are included in the Key Availability 
Check Data Object. 

Table 6: Coding of the Key Availability Check Data Object 



Description 


Value 


M/O 


Length (bytes) 


Local Key Establishment 
Control TLV 


Coded as defined in 
section 7.1 .2.6. The value 
field shall be set to '02' 


M 


B 


Key Identifier TLV 


Coded as defined in 
section 7.1.2.6.1 


M 


C 



Response parameters/data, Local Key Establishment security context (Key Availability Check mode), command 
successful: 



Byte(s) 


Description 


Coding 


Length 


1 


Key Availability Check Operation Response 
Data Object tag ('73') 


As defined in TS 31.101 [11] for 
BER-TLV data object 


1 


2 to 1+A1 bytes (A1 < 4) 


Key Availability Check Operation Response 
Data Object length (L1 ) 


As defined in TS 31.101 [11] for 
BER-TLV data object 


A1 


A1+2 to (A1+L1+1) 


Key Availability Check Operation Response 
Data Object 




L1 



- Key Availability Check Operation Response Data Object content: The TLV defined in table 7 is included in the 
Key Availability Check Operation Response Data Object. 

Table 7: Coding of the Key Availability Check Operation Response Data Object 



Description 


Value 


M/O 


Length (bytes) 


Local Key Establishment Control TLV 


Coded as defined in 
section 7.1.2.6. The 
value field shall be 
set to 'DB' 


M 


B 
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7.2 Void 



7.3 Status Conditions Returned by the USIM 

Status of the card after processing of the command is coded in the status bytes SW1 and SW2. This clause specifies the 
coding of the status bytes in the following tables, in addition to the ones defined in TS 31.101 [11]. 

7.3.1 Security management 



SW1 


SW2 


Error description 


'98' 


'62' 


- Authentication error, incorrect MAC 


'98' 


'64' 


- Authentication error, security context not supported 


'98' 


'65' 


- Key freshness failure 


'98' 


'66' 


- Authentication error, no memory space available 


'98' 


'67' 


■ Authentication error, no memory space available in EFmuk 
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7.3.2 Status Words of the Commands 

The following table shows for each command the possible status conditions returned (marked by an asterisk *). 



Commands and status words 



Status Words 


AUTHENTICATE 


90 00 


* 


91 XX 


* 


93 00 




98 50 




98 62 


* 


98 64 


* 


98 65 


* 


98 66 


* 


98 67 


* 


62 00 


* 


62 81 




62 82 




62 83 




62 F1 


* 


62 F3 


* 


63 CX 




63 F1 


* 


64 00 


* 


65 00 


* 


65 81 


* 


67 00 


* 


67 XX - (see note) 


* 


68 00 


* 


68 81 


* 


68 82 


* 


69 81 




69 82 


* 


69 83 




69 84 


* 


69 85 


* 


69 86 




6A 80 




6A81 


* 


6A 82 




6A 83 




6A 86 


* 


6A 87 




6A 88 


* 


6B00 


* 


6E 00 


* 


6F00 


* 


6F XX - (see note) 


* 


NOTE: Except SW2 = '00'. 
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7.4 Optional commands 

The following command is optional for the USIM application: 

- GET CHALLENGE command as defined in TS 3 1 . 1 1 [ 1 1 ] . 

Note: OMA BCAST Smart Card Profile [49] defines a command using instruction code INS 'IB' 



8 Void 
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Annex A (informative): 

EF changes via Data Download or USAT applications 

This annex defines if changing the content of an EF by the network (e.g. by sending an SMS), or by a USAT 
Application, is advisable. Updating of certain Efs "over the air" such as EF ACC could result in unpredictable behaviour 
of the UE; these are marked "Caution" in the table below. Certain Efs are marked "No"; under no circumstances should 
"over the air" changes of these Efs be considered. 



File identification 


Description 


Change advised 


'2F00' 


Application directory 


Caution 


'2F05' 


Preferred languages 


Yes 


'2F06' 


Access rule reference 


Caution 


'2FE2' 


ICC identification 


No 


'4F01' 


Launch SCWS 


Yes 


'4F20' 


Image data 


Yes 


"4F20" 


GSM Ciphering key Kc 


No 


'4FXX' 


Image Instance data Files 


Yes 


'4F21' 


ICE graphics 


Yes 


'4FXX' 


Icon 


Yes 


'4FXX 


Unique identifier 


Yes 


'4F22' 


Phone book synchronisation counter 


Yes 


'4F23' 


Change counter 


Yes 


'4F24' 


Previous unique identifier 


Yes 


'4F30' 


Phone book reference file 


Yes 


'4FXX 


Capability configuration parameters 1 


Yes 


'4F30' 


SoLSA Access Indicator 


Caution 


■4F31' 


SoLSA LSA List 


Caution 


'4FXX 


LSA Descriptor files 


Caution 


"4F52" 


GPRS Ciphring key KcGPRS 


No 


'4F63' 


CPBCCH Information 


No 


'4F64" 


Investigation Scan 


Caution 


'4FXX 


Additional number alpha string 


Yes 


'4FXX 


Additional number 


Yes 


'4FXX 


Second name entry 


Yes 


'4FXX 


Grouping information alpha string 


Yes 


'4FXX 


Phone book control 


Yes 


'4FXX 


E-mail addresses 


Yes 


'4FXX 


Index administration phone book 


Yes 


'4FXX 


Extension 1 


Yes 


'4FXX 


Abbreviated dialling numbers 


Yes 


'4FXX 


Grouping file 


Yes 


'4F41' 


Pseudonym 


Caution 


'4F42' 


User controlled PLMN selector for l-WLAN 


No 


'4F43' 


Operator controlled PLMN selector for l-WLAN 


Caution 


'4F44' 


User controlled WSID List 


No 


'4F45' 


Operator controlled WSID List 


Caution 


'4F46' 


WLAN Reauthentication Identity 


No 


4F47' 


Home l-WLAN Specific Identifier List 


Yes 


'4F47' 


Multimedia Messages List 


Yes 


'4F48' 


l-WLAN Equivalent HPLMN Presentation Indication 


Yes 


'4F48' 


Multimedia Messages Data File 


Yes 


'4F49' 


l-WLAN HPLMN Priority Indication 


Yes 


'4F4A' 


l-WLAN Last Registered PLMN 


Caution 


'4F4B' 


HPLMN Direct Access Indicator 


Yes 


'4F81' 


Allowed CSG lists 


Yes 


'4F82' 


CSG Type 


Yes 


'4F83' 


HNB name 


Yes 


'4F84' 


Operator CSG lists 


Yes 


'4F85' 


Operator CSG Type 


Yes 


'4F86' 


Operator HNB name 


Yes 
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(^pi itinn 

— 1 Cl L.I L 1 \J 1 1 


'6F73' 


Parkpt ^witrhpd Innatinn infnrmatinn 

1 ClUl\C L OVVILUI IUU IUUCILI U 1 1 1 1 1 1 U 1 1 1 1 CI LI U 1 1 


Oantinn (Notp 11 

U CI U II U 1 1 \ 1 M U LU 1 / 


'6F78' 


Appp<?9 pontrol pla<5<i 

nuucoo uui ili ui uicioo 


Cai itinn 

W Cl U HUM 


'6F7B' 


Fnrhiddpn PI MN^ 

1 U 1 U IUU CI 1 1 1 1 VI 1 MO 


P.qi itinn 

W Cl U HUM 


'6F7E' 


1 npption infnrmptinn 

1 UUCllIU II IlllUlllldllUII 


No ^Notp 1 1 

1 mu y\ MUlC 1 j 


'6F80' 


Inpnminn rail infnrmatinn 

11 1 UU 1 1 1 1 1 iy UQ 1 1 1 1 1 1 U 1 1 1 1 Cl L 1 U 1 1 


Yes 


'6F81' 


Outnninn pall infnrmatinn 

w u lyuniy uciii iiiiuiiiiciliuii 


Yes 


'6F82' 


Inpnminn pall timpr 

iiiuuiiiniy uciii iiiiici 


Yes 


'6F83' 


Outnninn pall timpr 

w u iy u 1 1 iy uciii iiiiici 


Yes 


'6FAD' 


Admini^tratix/p data 

/\U I I III 1 1 o L I d Live; Uula 


Dai itinn 

w Cl U HUM 


'6FB1 ' 


Vnipp Cnrnnn C^all Sprvipp 

v u i uc yj i u u u uqi i oci v iuc 


Yes 


'6FB2' 


Vnipp Cnrnnn C^all Sprvipp Status 

V U 1 UC s-J IUU|J Wdl 1 OCI v IUC O LCILUO 


Yes 


'6FB3' 


Vnipp Rrnadpa^t Sprvipp 

V UlUC LJ 1 UdUUao I vJCI V IUC 


Yes 


'6FB4' 


Vnipp Rrnadpa^t Sprvipp Status 

V UlUC LJ 1 UClUUCIO L OCI V IUC O LCILUO 


Yes 


'6FB5' 


Fnhanppd Mnlti 1 pvpI Prp-pmntinn and Prinritv 

1 1 1 1 1 Gil IUC U IVIUILI 1— C VCI 1 IC CIIIULIUII ClIIU 1 IIUIILy 


Yes 


'6FB6' 


Autom3tic AnswGr for gMLPP SGrvicG 


Yes 


'6FB7' 


EmGrgGncy Call Codes 


Caution 


'6FC3' 


Key for hiddon phonG book GntriGS 


No 


'6FC4' 


Network ParametGrs 


No 


'6FC5' 


PLMN Network Name 


Yes 


'6FC6' 


Operator Network List 


Yes 


'6FC7' 


Mailbox Dialling Numbers 


Yes 
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Filp idpntif iration 

1 II 1 U v 1 1 L 1 1 1 wU 1 1 \J 1 1 


Df^rrint ion 


Channp advi^pri 

1 1 (_i i i y v — nu v iovu 


'6FC8' 


FvtpnQinn fi 

1 ALCI IOIUI 1 \J 


Yes 


'6FC9' 


Mpilhnv IHpntifipr 

1 V Id 1 VJ \J A IUCI 1 LM ICI 


P.qi itinn 

W CI U 11 \J 1 1 


'6FCA' 


iwipccanp Wpitinn Inrlin^tinn fitatiiQ 

IVIUOOCI^ C V V d 1 LI 1 ly IIIVJIV^CiLIVJII \J LCHUC5 


("lai itinn 

WCLU LI 1 1 


'6FCB' 


Hall Fnrwarrlinn Indiratinn Status 

w a 1 1 i vj i vv ai u 1 1 ly iiiuiociliijii o laiu o 


Opi itinn 

WCIU 11 1 1 


'6FCC 


FvtpnQinn 7 

1 ALCI IOIUI 1 / 


Yes 


'6FCD' 


Rprvifp Prnvirlpr DiQnlav Infnrmatinn 

w C7 1 V IOC 1 1 UVIUCI 1 ' lOkJICl V II 1 1 VJ 1 1 1 ICI I IV-/ 1 1 


Yes 


'6FCE' 


MMQ Nntif iratinn 

1 VI 1 VI vJ INvJLIIIWClLIVJI 1 


Yes 


'6FCF' 


FvtpnQinn ft 

1 ALCI IOIUI 1 (J 


Yes 


'6FD0' 


MMfi iQQiipr ("^nnnprtivitv PpramptprQ 

IVIIVIvJ lOOUvl VJVJ 1 1 1 1 Cvy 11 V 1 ly 1 CI 1 Ql 1 ICICI O 


Yes 


'6FD1 ' 


MMS 1 Iqpc PrpfprpnnpQ 

IVIIVIU UOCI 1 ICICICIH_»CO 


Yes 


'6FD2' 


yy.Q 1 Icpr Onnnpptivitv Par^mptprQ 

IVIIVIU UOCI WUI II ICLiLI V 1 ly 1 Ql Ol 1 1 C IC 1 O 


Yes 


'6FD3' 


Nptwnrk'Q inrlioptinn nf alprtinn fNIA^ 

IVICLVVVJIrAO II 1 Wi 1 KjCA LI Ul 1 Ul Cll C 1 LI 1 i y I 1 N 1 1 \ I 


Opi itinn 

w CI U L 1 U 1 1 


'6FD4' 


Vnipp f-imun Oall Rpcvipp P^inhprinn Alnorithm 

v uiLiC \j i uup well i uci vivjC V-/I lji ici ii ly / Vi y vj 1 ilium 


Yes 


'6FD5' 


Vnipp RrnanVpQt Sprviop Oinhprinn Alnorithm 

v \j iV/C ui uquvjcio i uci viuc w i [J i ici ii ly / \i y vj i ilium 


Yes 


'6FD6' 


f-iRA RnntQtranninn nprpmptprQ 

\J 1— '/V UUULoll &LJLJI 1 ly LJdl cll 1 ICLCI O 


P.qi itinn 

w a u ii vj 1 1 


'6FD7' 


MRM9 Sprvirp Kpv^ 1 i^t 

1 V 1 LJ 1 V 1 W UCI VILyC i\cyo 1 IOI 


Opi itinn 

w a u ii vj 1 1 


'6FD8' 


MBMS Uspr Kpv 

1 V 1 L_M V 1 w UOCI l\Cy 


Opi itinn 

w a u l i vj i i 


'6FD9' 


EHPLMN 

1 1 II l—l VI 1 M 


Opi itinn 

wau ii vj i i 


'6FDA' 


GBA NAF List 

1 ' i \ IMrll 1 IOL 


f^ai itinn 

wau li \J I I 


'6FDB' 


FHPI MN PrpQpntptinn Inrlinatinn 

1 1 II l—IVIIM 1 ICOCII LCI LI VJ II IIIVJIOCILIWII 


Opi itinn 

wau L l \J l l 


'6FDC 


Last RPLMN Selection Indication 


Caution 


DrUU 


INMn r\cy UcllLic MUUicoo 


f 1 o i i ti n 
L/dUUUI 1 


'RFDF' 
Drue 


OclVlUc PIUVIUcI INcilllc IUUII 


Ypq 

1 CO 


'RFDF' 
Drur 


PI MM MotiA/rtrU' Mama If/in 
nLIVIlN INclWUIIx INctlllc IUUI 1 


Ypq 

T co 


'RFFD' 


1 n i q co nf P m o rnonM/ q 1 1 i nri Mm mho r 

iii uaoc ui c\ i ici yci loy — L/idiiniy inuiiiuci 


Ypq 

I CO 


'RFF1 ' 
urc i 


in Oaoc ui mi i ici yui luy — rice runiicu 


Ypq 

I CO 


'RFF9' 


MotvA/nrk' i^n n nDPt i\/it\/ PorQ m o+o rc f n v 1 1 1 fT~* 1 P 
INcLWUI r\ uUI II IcUllvliy i Cll Cll 1 Iclcl o IUI Uluvv In 

mnnpptinnQ 

W \J 1 II ICULIUI IO 


Ypq 

I CO 


'6FE3' 


FPR Inpptinn infnrmatinn 

1 1 w IWV^CILIWI 1 II 1 1 W 1 1 1 I a LI W 1 1 


Oautinn (Nofp 1 \ 

UaUUUI I M M VJ LC 1 J 


'6FE4' 


FPS NAS Spmritv Cnntpxt 


Cn\ itinn 

wau Liu I I 


'6FE5' 


Pnhlir Sprvirp Idpntitv nf thp RM-RC 

1 UIU/IIV^ UCI VILyC IUCI HILy UI 11 IC UIVI \J\J 


Yes 


'6FE6' 


USAT Facility Control 


Caution 


'6FE7' 


UICC IARI 


Caution (Note 3) 


'6FE8' 


Non Access Stratum Configuration 


Yes 


'6FE9' 


UICC certificate 


Yes 


'6FEA' 


Relay Node ID 


Yes 


'6FEB' 


Max value of Secure Channel counter 


Caution 


N0TE1 : If EFimsi is changed, the UICC should issue REFRESH as defined in TS 31 .1 1 1 and update 


EFloci. EFpsloci and EF E psloci accordingly. 
NOTE2: This file may contain eCALL related test and reconfiguration numbers. 




NOTE3: If EFuicciari is changed, the UICC shall issue a REFRESH command as defined in TS 31 .1 1 1 . 

The ME shall read the updated list of lARIs associated with active applications installed on the 
UICC. 
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Annex B (normative): 
Image Coding Schemes 



The following image coding schemes are applicable to rectangular raster images. Raster image points are assumed to be 
of square shape. They are numbered sequentially from 1 onwards, starting at the upper left corner, proceeding line by 
line downwards, each line in turn proceeding from left to right, and ending at the image's lower right corner. 

The following example illustrates the numbering scheme for raster image points by showing how the corner points are 
numbered, assuming an image length of x points and an image height of y points. 



1 


X 


(x*(y-D + D 


(x*y) 



B.1 Basic Image Coding Scheme 

This coding scheme applies to rectangular raster images made up of raster points that are either set or not set. This 
coding scheme does not support any notion of colour. Image data are coded as follows: 



Byte(s) 


Description 


Length 


1 


image width = X 


1 


2 


image height = Y 


1 


3 to K+2 


image body 


K 



Coding of image body: 



The status of each raster image point is coded in one bit, to indicate whether the point is set (status = 1) or not set 
(status = 0). 



Byte 1: 



B8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



Byte 2: 



status 


of 


raster 


point 


8 


status 


of 


raster 


point 


7 


status 


of 


raster 


point 


6 


status 


of 


raster 


point 


5 


status 


of 


raster 


point 


4 


status 


of 


raster 


point 


3 


status 


of 


raster 


point 


2 


status 


of 


raster 


point 


1 



B8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



status 


of 


raster 


point 


16 


status 


of 


raster 


point 


15 


status 


of 


raster 


point 


14 


status 


of 


raster 


point 


13 


status 


of 


raster 


point 


12 


status 


of 


raster 


point 


11 


status 


of 


raster 


point 


10 


status 


of 


raster 


point 


9 



etc. 



Unused bits shall be set to 1 . 
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B.2 Colour Image Coding Scheme 

This coding scheme applies to coloured rectangular raster images. Raster image point colours are defined as references 
into a colour look-up table (CLUT), which contains a subset of the red-green-blue colour space. The CLUT in turn is 
located in the same transparent file as the image instance data themselves, at an offset defined within the image instance 
data. 

Image data are coded as follows: 



Byte(s) 


Description 


Length 


1 


Image width = X 


1 


2 


Image height = Y 


1 


3 


Bits per raster image point = B 


1 


4 


Number of CLUT entries = C 


1 


5 to 6 


Location of CLUT (Colour Look-up Table) 


2 


7 to K+6 


Image body 


K 



Bits per raster image point: 
Contents: 

- the number B of bits used to encode references into the CLUT, thus defining a raster image point's colour. B 
shall have a value between 1 and 8. 

Coding: 

- binary. 

Number of entries in CLUT: 
Contents: 

the number C of entries in the CLUT which may be referenced from inside the image body. CLUT entries are 
numbered from to C-l. C shall have a value between 1 and 2**B. 

Coding: 

- binary. The value shall be interpreted as 256. 
Location of CLUT: 

Contents: 

this item specifies where the CLUT for this image instance may be found. The CLUT is always located in the same 
transparent file as the image instance data themselves, at an offset determined by these two bytes. 

Coding: 

- Byte 1 : high byte of offset into Image Instance File. 

- Byte 2: low byte of offset into Image Instance File. 

Image body: 
Coding: 

each raster image point uses B bits to reference one of the C CLUT entries for this image instance. The CLUT entry 
being thus referenced yields the raster image point's colour. The image body is arrayed as for the Basic Colour Image 
Coding Scheme, that is, starting with the highest bit of the first raster image point's colour information. 

Byte 1: 



B8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 



. . . etc 
. . . etc 
. . . etc 
. . . etc 
. . . etc 

Bit B-2 of raster point 1 CLUT reference 
Bit B-l of raster point 1 CLUT reference 
Bit B (MSB) of raster point 1 CLUT reference 



etc. 



ETSI 



3GPP TS 31.102 version 11.3.0 Release 11 



205 



ETSI TS 1 31 1 02 V1 1 .3.0 (201 2-1 0) 



Unused bits shall be set to 1 . 

The CLUT (Colour Look-up Table) for an image instance with C colours is defined as follows: 
Contents: 

- C CLUT entries defining one colour each. 
Coding: 

- the C CLUT entries are arranged sequentially: 



Byte(s) of CLUT 


CLUT Entry 


1-3 


entry 






3*(C-1)+1 to 3*C 


Entry C-1 



Each CLUT entry in turn comprises 3 bytes defining one colour in the red-green-blue colour space: 



Byte(s) of CLUT entry 


Intensity of Colour 


1 


Red 


2 


Green 


3 


Blue 



A value of 'FF' means maximum intensity, so the definition 'FF' '00' 00' stands for fully saturated red. 
NOTE 1 : Two or more image instances located in the same file can share a single CLUT. 

NOTE 2: Most MEs capable of displaying colour images are likely to support at least a basic palette of red, green, 
blue and white. 



B.3 Colour Image Coding Scheme with Transparency 

This coding scheme is identical to the Colour Image Coding Scheme as defined in appendix B.2, with the following 
exception: 

Entry number C-1 in the colour look-up table (CLUT), where C is the number of entries in the CLUT, 
defines transparency. Raster image points which point to this entry are transparent, so that the underlying 
colour in the display is shown. 

The three colour-coding bytes of entry number C-1 in the CLUT are of no importance when referenced from images 
using the '22' coding scheme. 

NOTE: Two different descriptors in the EF IMG file with Image Coding Scheme '21' and '22' may point to the same 
actual image instance. In that case, the descriptor with Image Coding Scheme '21' would describe an 
image where a raster image point pointing to entry number C-1 in the CLUT would have the colour 
described in that CLUT entry, while the descriptor with Image Coding Scheme '22' would describe an 
image where a raster image point pointing to entry number C-1 in the CLUT is transparent. 
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Annex C (informative): 

Structure of the Network parameters TLV objects 

Structure of the GSM network parameter TLV object, 0<= m <=32 



Tag 


Length 


Tag 
Currently 
Camped 
Frequenc 

y 


Length 


BCCH 
Frequenc 

y 

downlink 


Tag 
Neighbour 

BCCH 
Frequency 


Length 


BCCH 
Neighbour 
Frequency 
1 


BCCH 
Neighbour 
Frequency 
2 




BCCH 
Neighbour 
Frequency 
m 


'AO' 




'80' 


'02' 


I 


'81' 




I 


I 


I 


I 



Structure of the FDD network parameter TLV object, <= m <= 32 



Tag 


Length 


Tag 
Intra 
frequency 
carrier 


Length 


Intra 
Frequency 
downlink 
carrier 


Primary 
Scrambling 
code 1 


Primary 
Scrambling 
code m 


Tag 
Inter 
frequency 
carrier 


Lengt 
h 


Inter 
Frequency 
downlink 
carrier 


Primary 
Scrambling 
code n1 


■A1" 




'80' 




I 


I 


I 


'81' 




I 


I 


Structure of the TDD network parameter TLV object, <= m <= 32 


Tag 


Length 


Tag 
Intra 
frequency 
carrier 


Length 


Intra 
Frequency 
downlink 
carrier 


Primary 
Scrambling 
code 1 


Primary 
Scrambling 
code m 


Tag 
Inter 
frequency 
carrier 


Lengt 
h 


Inter 
Frequency 
downlink 
carrier 


Primary 
Scrambling 
code n1 


'A2' 




'80' 










'81' 
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Annex D (informative): 
Tags defined in 31 .102 



Tag 


Name of Data Element 


Usage 


'53' 


MBMS Data Object 


AUTHENTICATE command parameter, 
in MBMS security context 


'53' 


MBMS operation response Data Object 
The following tags are encapsulated within '53' 
'DB' successful MBMS operation tag 


Response to AUTHENTICATE 
command, in MBMS security context 


'73' 


Key Derivation Data Object 

The following tags are encapsulated within '73' 

'80' Local Key Establishment Control tag 

'81' Counter limit tag 

'82' Request MAC tag 

'83' NAF ID tag 

84 TermmaMD tag 

'85' Terminal_appli_ID_tag 

ob uiouappiiiu tag 

'ft7' RAMRy tan 

Of llMI N UA Ldy 

'AO' Key Identifier tag 


AUTHENTICATE command parameter, 
in Local Key Establishment security 
context 


'7V 


r\uy uyrivdiiuii vjptjrduuii ncbpuribc vjujcoi 

1 lie lUIIUWIIiy Ldyb dltJ tJIIL-dpoUldltJU Wl LI 1 1 1 1 / o 
'fifl' 1 ncal Kpv Fc;tahlicihmpnt 0,nntrnl tan 

OU 1— Ulrdl l\Cy L_o LclUI lol 1 1 1 Id 1 L wuiiliui Ldy 

'82' Request MAC tag 


Rocnnnco tn Al ITMFMTIPATF 

oui i ii i icu iu, iii i-uocii r\t;y ^biciuiibiiiiicnii 


'73' 


Kpv Availability Ohpnk Data Obipnt 

The following tags are encapsulated within '73' 

'80' Local Key Establishment Control tag 

'AO' Key Identifier tag 


AUTHENTICATE command parameter 
in Local Key Establishment security 
context 


'80' 


NAF ID tag 


GBA NAF List (EFqbanl) 


'80' 


NAF Key Centre address tag 


NAF Key Centre Address (EFnafkca) 


'80' 


Icon Tag (Icon link is URI) 


Service Provider Name Icon (EFspni) 


'80' 


Reauthentication Identity tag 


WLAN Reauthentication Identity 
(EFwri) 


'80' 


Graphics CSG Type tag (Icon link is URI) 


CSG TvDe (EFrsQ-r) 


'80' 


HNB Name tag 


Home NodeB Name (EFhnbn) 


'80' 


ICE Free Format Label tag 


In Case of Emergency - Free Format 

(efice-ff) 


'81' 


B-TID tag 


GBA NAF List (EFqbanl) 


'81' 

O 1 


Imn Tan (\rnn link i<i rpmrrl niimhpr^ 

ILUI 1 1 dU I HjU 1 1 llllrx 1 o ICLUIU 1 1 U 1 I 1 Ud ) 


^prvipp Prn\/iHpr Mamp Ipnn fFF^nMi\ 
uci viuc niuviud iNdiiic iolm i ^tnspiMiy 


'81' 


Master key tag 


WLAN Reauthentication Identity 
(EFwri) 


'81' 


Time Stamp counter tag 


MBMS User Key (EFmuk) 


'81' 


Graphics CSG Type tag (Icon link is record number) 


CSG Type (EFcsgt) 


'81' 


ICE Free Format Content tag 


In Case of Emergency - Free Format 

(efice-ff) 


'82' 


Counter tag 


WLAN Reauthentication Identity 
(bhwRl) 


'89' 


Text CSG Type tag 


CSG Type (EFcsgt) 


AU 


iviurv iu lag 

The following tags are encapsulated within 'AO' 
'80' MUk IDr tag 
'82' MUk IDi tag 


ividivio user i\ey (etmuk) 


'AO' 


EPS NAS security Context tag 

The following tags are encapsulated within 'AO' 

'80' Key set identifier KSIasme Tag 

'81' ASME key (Kasme) Tag 

'82' Uplink NAS count Tag 

'83' Downlink NAS count Tag 

'84' Identifiers of selected NAS integrity and encryption 
algorithms Tag 


EPS NAS Security Context (EFepspsc) 


'AO' 


CSG List TLV object tag 

The following tags are encapsulated within 'AO' 


Allowed CSG List (EFacsgl) 
Operator CSG List (EFqcsgl) 
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'80' PLMN tag 

'81' CSG Information tag 




'AO' 


GSM cell information 

The following tags are encapsulated within 'AO': 

'80' GSM Camping Frequency Information data object 
'81 ' GSM Neighbour Frequency Information data object 


Network Parameters (EFnetpar) 


■A1' 


FDD cell information 

The following tags are encapsulated within 'A1': 

'80' FDD Intra Frequency Information data object 
'81 ' FDD Inter Frequency Information data object 


Network Parameters (EFnetpar) 


'A2' 


TDD cell information 

The following tags are encapsulated within 'A2': 

'80' TDD Intra Frequency Information data object 
'81 ' TDD Inter Frequency Information data object 


Network Parameters (EFnetpar) 


'A3' 


Service provider display information 
The following tags are encapsulated within 'A3': 
'80' Service provider PLMN list 


Service Provider Display Information 
(EFspdi) 


'A8' 


Indicator for type 1 EFs (amount of records equal to master EF) 
The following tags are encapsulated within 'A8': 

'CO' EFadn data object 

'C1' EFiap data object 

'C3' EFsne data object 

'C4' EFanr data object 

'C5' EFpbc data object 

'C6' EFqrp data object 

'C9' EFuid data object 

'CA' EFemail data object 


Phone Book Reference File (EFpbr) 


'A9' 


Indicator for type 2 EFs (EFs linked via the index administration file) 
The following tags are encapsulated within 'A9': 

'C3' EFsne data object 

'C4' EFanr data object 

'CA' EFemail data object 


Phone Book Reference File (EFpbr) 


'AA' 


Indicator for type 3 EFs (EFs addressed inside an object using a 

record identifier as a pointer) 

The following tags are encapsulated within 'AA': 

'C2' EFexti data object 

'C7' EFaas data object 

'C8' EFgas data object 

'CB' EFccpi data object 


Phone Book Reference File (EFpbr) 


'AB' 


MMS Connectivity Parameters: 

The following are encapsulated under "AB": 

"80" MMS Implementation Tag 

"81 " MMS Relay/Server Tag 

"82" Interface to core network and bearer Tag 

83 Gateway Tag 

'84' Reserved for 3GPP2: MMS Authentication Mechanism Tag 
'85' Reserved for 3GPP2: MMS Authentication User Name Tag 


MMS Connectivity Parameters 

(EFmmsicp / EFmmsucp) 


Ud 


Successful 3G authentication 


riesponse to au i men i ioa i c 


Ub 


Successful VGCS/VBS operation authentication tag 


Dnpnnnrn tr\ Al ITUCMTIPATC 

riesponse to au i ntiN i ioa i l 


'DB' 


Successful GBA operation tag 


Response to AUTHENTICATE 


'DC 


Synchronisation failure 


Response to AUTHENTICATE 


'DD' 


Access Point Name 


APN Control List (EFacl) 


'DD' 


GBA Security Context Bootstrapping Mode tag 


AUTHENTICATE command parameter, 
in GBA security context 


'DE' 


GBA Security Context NAF Derivation Mode tag 


Response to AUTHENTICATE 



NOTE: the value 'FF' is an invalid tag value. For ASN.l tag assignment rules see ISO/IEC 8825-1 [35] 
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Annex E (informative): 

Suggested contents of the EFs at pre-personalization 

If EFs have an unassigned value, it may not be clear from the main text what this value should be. This annex suggests 
values in these cases. 



File Identification 


Description 


Value 


'2F00' 


Application directory 


Card issuer/operator dependent 


'2F05' 


Preferred languages 


'FF...FF' 


'2F06' 


Access rule reference 


Card issuer/operator dependent 


'2FE2' 


ICC identification 


operator dependent 


'4F01' 


Launch SCWS 


Operator dependent 


'4F20' 


Image data 


'00FF...FF' 


L "4F20" 


GSM Ciphering key Kc 


'FF...FF07' 


'4FXX' 


Image instance data files 


'FF...FF' 


'4F21' 


ICE graphics 


'FF...FF' 


4FXX' 


Icon 


Operator dependent 


'4FXX 


Unique identifier 


'0000' 


'4F22' j 


Phone book synchronisation counter 


'00000000' 


'4F23' 


Change counter 


'0000' 


'4F24' 


Previous unique identifier 


'0000' 


'4F30' 


Phone book reference file 


Operator dependent 


'4F30' 


SoLSA Access Indicator 


'00FF...FF' 


'4F31' 


SoLSA LSA List 


'FF...FF' 


'4FXX' 


LSA Descriptor files 


'FF...FF' 


'4FXX 


Capability configuration parameters 1 


'FF...FF' 


"4F52" 


GPRS Ciphring key KcGPRS 


'FF...FF07' 


'4F63' 


CPBCCH Information 


'FF..FF' 


'4F64' 


Investigation PLMN scan 


'00' 


'4FXX 


E-mail addresses 


'FF...FF' 


'4FXX 


Additional number alpha string 


'FF...FF' 


'4FXX 


Second name entry 


'FF...FF' 


'4FXX 


Abbreviated dialling numbers 


'FF...FF' 


'4FXX 


Grouping file 


'00... 00' 


'4FXX 


Grouping information alpha string 


'FF...FF' 


'4FXX 


Phone book control 


'0000' 


'4FXX 


Index administration phone book 


'FF...FF' 


'4FXX 


Additional number 


'FF...FF' 


'4FXX 


Extension 1 


'00FF...FF' 


'4F41' 


Pseudonym 


'00FF...FF' 


'4F42' 


User Controlled PLMN selector for l-WLAN 


'FF...FF' 


'4F43' 


Operator Controlled PLMN selector for I- 
WLAN 


Operator dependent 


'4F44' 


User Controlled WSID list 


'00FF...FF' 


'4F45' 


Operator controlled WSID list 


Operator dependent 


'4F46' 


WLAN Reauthentication Identity 


'FF...FF' 


'4F47' 


Home l-WLAN Specific Identifier List 


Operator dependent 


'4F47' 


Multimedia Messages List 


'FF...FF' 


'4F48' 


l-WLAN Equivalent HPLMN Presentation 
Indication 


Operator dependent 


'4F48' 


Multimedia Messages Data File 


'FF...FF' 


'4F49' 


l-WLAN HPLMN Indication 


Operator dependent 


'4F4A' 


l-WLAN Last Registered PLMN 


'FFFFFF' 


'4F4B' 


HPLMN Direct Access Indicator 


Operator dependent 


'4F81' 


Allowed CSG lists 


Operator dependent 


'4F82' 


CSG Type 


Operator dependent 


'4F83' 


HNB name 


Operator dependent 


'4F84' 


Operator CSG lists 


Operator dependent 


'4F85' 


Operator CSG Type 


Operator dependent 


'4F86' 


Operator HNB name 


Operator dependent 


'6F05' 


Language indication 


'FF...FF' 
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brUb 


ACCGSS rule reTGrGnCG (unaer AUrusiM ana 
DFjelecom) 


oara issuer/operaior aepenaeni 


DrU / 


1 IVIOI 


Onoratnr HonDnrlDnt 
wpcicllUi UUpcllUclU 


'RFOfi' 
oruo 


uipilcillly dllu llllcyiliy ftcyb 


'07FF FF' 
\j i rr...rr 




Oipilcilliy dllu llllcyiliy ftcyb IUI pduftcl 
QwitnhpH Hnmain 

O vv 1 LUI ICU UUI 1 1 Q 1 1 1 


'07FF FF' 
\j t rr...rr 


'6F2C 


r)p-nprQnnali7atinn nnntrnl kpv^ 

i-J c uciouiidii^-dLiuii lui i li u i r\cy o 


'FF.fF 


'6F31' 


Hinhpr Prinritv PI MN Qpamh nprinrl 

1 1 i y 1 1 C 1 1 1 1 U 1 1 L V 1 1— 1 VI 1 N OGQI Ol 1 UCI IUU 


'FF' 


'6F32' 


On-nnprati\/p nptwnrk li^t 

wu upci a L 1 V C 1 ICLVVUI l\ IIOL 


'FF...FF' 


'6F37' 


AOM maYimum valnp 

f\\-J 1 VI II IOAI 1 1 1 I 1 1 r 1 VUIUC 


'nnnnnn' ^pp nntp 11 

UUUUUU l^OCC 1 IULC 1 j 


'6F38' 


I ISIM Qprvinp tahlp 

UO II VI OCI VIUC LaL/IC 


Onpratnr rlpnpnrlpnt 

UJJCI CI LU 1 UCpCI IUCI IL 


'6F39' 


Anm imi ilatprl pall mptpr 

rAUUUI 1 lUlulCU UClll IIICICI 


'000000' 

UUUUUU 


'6F3B' 


FiypH rliallinn nnmhprci 

i iauu u i cii 1 1 1 iy 1 1 u 1 1 iuc i o 


'FF...FF' 


'6F3C 


Shnrt mp^Q3np^ 


'00FF...FF' 


'6F3E' 


Orniin iHpntifipr Ip\/pI 1 

VJI UUU IUCIILIIICI ICVCI 1 


Onpratnr rlpnpnrlpnt 

WUC 1 dLUI UCpCI IUCI 11 


'6F3F' 


Orniin iHpntifipr IpvpI ? 

\JI UUU IUCI ILIIICI ICVCI t— 


Onpratnr rlpnpnrlpnt 

U[JCI dLUI UCUCI IUCI 11 


'6F40' 


MRIfiDN qtnranp 

lvlwliJL/1 >l OLUICiyC 


'FF...FF' 


'6F41' 


PUCT 


'FFFFFF0000' 

1 1 1 1 1 1 uuuu 


'6F42' 


SMS narampfpr^ 

OIVIO |Jal al 1 ICLCI O 


'FF...FF' 


'6F43' 


UIVIO OLCILUO 


'FF...FF' 


'6F45' 


CBMI 


'FF...FF' 


'6F46' 


Sprvinp nrnvirlpr namp 

UCI VlUC |JI U V IUCI 1 1 dl 1 1 C 


Onpratnr rlpnpnrlpnt 


'6F47' 


Shnrt mp^Qflnp Qtatn^ rpnnrt^ 

ui I U I i 1 1 icooayc oLaLUo I cpui 10 


'00FF ...FF' 


'6F48' 


CBMID 

Vw/ 1 > 1 V 1 1 1 — / 


'FF...FF' 


'6F49' 


Sprvinp Diallinn Nnrnhprc; 

wc i v luc ! » i a i 1 1 1 iy i n u i i i uc i o 


'FF ...FF' 


'6F4B' 


FYtpn^inn P 

1 ALCI IOIUI 1 <— 


'00FF...FF' 


'6F4C 


Fvtpnciinn *\ 

1 ALCI IOIUI 1 U 


'00FF...FF' 


'6F4D' 


Rarrpd niallinn Nurnhpr^ 

1 i Gl 1 1 C\_i 1 — / 1 CII 1 1 1 1 U 1 N U 1 1 1 Uwl O 


'FF...FF' 


'6F4E' 


FYtpn^inn S 

1 ALCI IOIUI 1 U 


'00FF...FF' 


'6F4F' 


Oanahilitv nnnfimiratinn naramptpr^ ? 

V-ZdkJdU 1 Illy UUI MiyUldLIUII kJCLI CLI 1 1 C LCI O L— 


'FF...FF' 


'6F50' 


OBMIR 

\J 1—1 1 VI 1 1 1 


'FF...FF' 


'6F54' 


Sptl In Mpnn Flpmpnt^ 

UvlUU IVICI IU 1 — IUI 1 IUI 1 lO 


Onpratnr dpnpndpnt 


'6F55' 


Extension 4 


'00FF...FF' 


DrOD 


n q hi oH CDn/iroc to aIo 
ClldUlcU bclvlucb IdUlc 


WpcidlUi UcpcilUcIU 


'6F57' 


Accgss point name control list 


'00FF...FF' 


OrOO 


uomparison metnoa inTormaTion 


ICC cp 

rr . . .rr 


DrOD 


Initialisation valuG for HypGrframG number 


icn nn nn cn nn nn 1 
rU UU UU rU UU UU 


'6F5C 


Maximum valuo of START 


Operator dependent 


'c err* r\' 

brbO 


User controllGd PLMN sGloctor with Accgss 
Tochnology 


• cr cr cr cr crcr a a f\c\ crcrcrcrcrcrAAAA' 
rrrrrr0000..rrrrrr0000 


brbl 


Operator controlled PLMN selector with 
Mccebb i eciiiiuiuyy 


Tirircririrnnnn l^I^I^I^I^I^nnnn , 
rrrrrrUUUU-.rrrrrrUUUU 




nrLIVMN bcltfClUI Willi rtCucbb icciniuiuyy 


'FFFFFFnnnn FFFFFFnnnn* 

rrrrr ruuuu. .rrrrrruuuu 


or / o 


ndCrxcl bWUCIIcU lUCdllUI 1 II IIUI 1 1 IdLIUI 1 


'FFFFFFFF FFFFFF yyyyyy 0000 FF 01' fepp 
rrrrrrrr rrrrrr aaaaaa uuuu rr u i ^bec 

note 2) 


'6F78' 


Apppqq fnntrnl nlac;^ 


Onpratnr rlpnpnrlpnt 

U[JCI dLUI UCUCI IUCI II 


'6F7B' 


Fnrhiddpn PI MKk 

1 UI UIUUUI 1 1 l—IVIIMO 


'FF...FF' 


'6F7E 


1 nnatinn infnrmatinn 

1 U UCI 11 Ull IIIIUIIIICLLIUII 


'FFFFFFFF xxxxxx 0000 FF 01' lqpp nntp 2) 

1 1 1 1 1 1 1 1 AAAAAA UUUU 1 1 UI LOCC IIU LC C— 1 


'6F80' 


Innnminn rail infnrmatinn 

iiiuuiiiiiiy uciii ii iiui ii iciliui i 


<pp FF 000000 00 01 FFFF' 

1 1 ...1 1 UUUUUU UU Ull 1 1 1 


'6F81' 


Outnninn nail infnrmatinn 

w u tyuiiiy udi i iiiiuiiiidLiuii 


'pp pp 000000 01 FFFF' 

1 1 ... 1 1 UUUUUU Ull 1 1 1 


'6F82' 


Innnminn nail timpr 

iiiuuiiiiiiy udi i l 1 1 1 1 c i 


'000000' 

UUUUUU 


'6F83' 


Outnninn nail timpr 

w u iy u 1 1 iy udi i iiiiici 


'000000' 

UUUUUU 


'6FAD' 


AHmini^trativp Hata 

r^u 1 1 1 1 1 1 IO LI Clll V C UCI LCI 


Onpratnr rlpnpnrlpnt 

wpc 1 dLUI UCpCI IUCI IL 


'6FB1 ' 


Vninp Ornun Hall Rprvinp 

V U IUC \J 1 U U U Wdl 1 OC 1 V luC 


Onpratnr rlpnpnrlpnt 

v[JCI dLUI UC|JCI IUCI 11 


'6FB2' 


Vninp Ornun ("lall fiprvinp Status 

V U IUC \J lUUp Wdl 1 OC 1 V IUC O LCI LU o 


Onpratnr rlpnpnrlpnt 

v[JCI dLUI UC|JC1 IUCI 11 


'6FB3' 


Vninp Rrnarlna^t Sprvinp 

V U IUC UI UCIUUCIO L UCI V IUC 


Onpratnr rlpnpnrlpnt 

u[jci ciiui ucpci IUCI 11 


'6FB4' 


Vninp Rrnarlnacit Rprvinp Status 

VUIUC 1— ' 1 UCIUUCIO L UClvlUC vJ LCI LU O 


Onpratnr rlpnpnrlpnt 

upci dLui ucpci IUCI 11 


'6FB5' 


EMLPP 


Ooerator denendent 


'6FB6' 


AaeM 


'00' 


'6FB7' 


Emergency call codes 


Operator dependent 


'6FC3' 


Key for hidden phone book entries 


'FF...FF' 


'6FC4' 


Network Parameters 


'FF...FF' 


'6FC5' 


PLMN Network Name 


Operator dependent 


'6FC6' 


Operator Network List 


Operator dependent 
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'6FC7' 


Mailnnv Diallinn Nnmhprci 

1 V ICll 1 VJ U A 1— ' 1 dl 1 1 1 1 y 1 N LI 1 1 \VJ\D\ O 


Onpratnr rlpnpnrlpnt 

U|JCI CILUI UC|JCI IUCI 11 


'6FC8' 


Fytpn^inn fi 

1 ALCI IOIUI 1 U 


-go FF...FF' 


'6FC9' 


Mpilhnv IHpntifipr 

1 v ICll 1 UUA IUCI 1 LI 1 1 C 1 


Onpratnr rlpnpnrlpnt 

V_y UC 1 CILUI UC|JCI IUCI 11 


'6FCA' 


Mpccarip Wpitinn Inrlinatinn Status 

IVICOO O V V Gil LI 1 ly IIIUIUCILIUII v_J LCllUO 


'00 00 00 00 00' 

UU UU UU wu wu 


'6FCB' 


Hall Fnrwarrlinn Inrlinatinn Status 

w a 1 1 i u i vv cii u i i ly iiiuiuciiiuii oiciiu o 


■ xx on pp pp< 

A A UU 1 1 ■ ■ ■ 1 1 


'6 FCC 


Fytpn^inn 7 

1 ALCI IOIUI 1 / 


'00 FF...FF' 


'6FCD' 


Sprvinp Prnvirlpr Dicinlpv Infnrmptinn 

v ' C 1 V I^C 1 IUVIUUI t—t IOUI d V II 1 IUI 1 1 1 CI LIU 1 1 




'6FCE' 


yyfi Nntifinatinn 

1 VI 1 VI v ' 1 NUll 1 1 U CI 1 1 U 1 1 


'00 00 00 FF FF' 

UUUUUUI 1 ...1 1 


'6FCF' 


Fytpnciinn R 

1 ALCI IOIUI 1 u 


'00FF...FF' 


'6FD0' 


yyQ iQQiipr Onnnpntivitv Parpmptprc; 

1 VI 1 VI V ' lo OUUI \_/ U 1 1 1 1 CU LI V 1 L V 1 CII CII 1 1 C LC 1 O 


'FF pp 


'6FD1 ' 


yiWIQ 1 Icpr Prpfprpnrpci 

IVIIvlw UOCI 1 1 CICI CI IIjCO 


'FF...FF' 


'6FD2' 


yyQ 1 Icpr Onnnpftivitv P^rpmptprc; 

IVIIVIw UOCI WU 1 1 1 1 CU LI V 1 L V 1 Ql ul 1 ICLCI O 


■pp pp' 


'6FD3' 


Nptwnrk'c. Inrlipptinn nf Alprtinn fNIA^ 

1 N C L Vv U li\0 II IU IUCI 11 U 1 1 Ul / ilCI Lilly 1 1 M 1 1 \ 1 


'FF...FF' 


'6FD4' 


Vnipp fnrniin OpII fiprvipp Oinhprinn Alnnrithm 

vuioc \j iuulj wcii i oci v iuc w i lj i ici ii ly niyui ilium 


'00. ..00' 


'6FD5' 


Vnipp RrnpHpp9t Spcvipp f^inhprinn Alnnrithm 

VUIOC Ul UaUL-ao L UCI V IOC w 1 lj 1 IC 1 II ly / \l y U 1 1 11 1 1 1 1 


'00... 00' 


'6FD6' 


C-5RA Rnnt^trpnninn nprpmptprc 

\J l—Jf \ UUULOll GUUI 1 ly [JCll CII 1 ICLCI O 


'FF...FF' 


'6FD7' 


MRMS Sprvirp Kpv^ 1 kt 

1 v 1 LJ 1 V 1 UCI V IUC IXCyO 1 IOI 


'FF...FF' 


'6FD8' 


MBMS IJqpr Kpv 

IVII_HVIv_J UOCI l\Cy 


'FF...FF' 


'6FD9' 


EHPL MN 

1 1 II l—l VI 1 N 


'FF FF' nr yyyyyy (qpp Nntp ?^ 

1 1 ...1 1 Ul A A A A A A I O IXULv C— 1 


'6FDA' 


GBA NAF List 

V^l 1 II \ IN/il 1 IOI 


'FF...FF' 


'6FDB' 


FHPI MN Prpc.pntatinn Inrliratinn 

1 1 II l_ 1 V 1 1 M 1 ICOCIILClLiUII IIIUIUCILIUII 


'00' 


L '6FDC 


Last RPLMN Selection Indication 


'00' 


XjiYJYJ 


INnr r\cy uclllic MUUicoo 


'FF FF' 
rr...rr 


'6FDE' 


Service Provider Name Icon 


'00 FF...FF' 


DrUr 


rLiviN NeiworK Name icon 


»nn cc pp» 
UU rr...rr 


DrtU 


In Case of Emergency — Dialling Number 


Operator dependent 


Drtl 


In Case of Emergency — Free Format 


Operator dependent 


'6FE2' 


Network Connectivity Parameters for UICC IP 
connections 


Operator dependent 


orto 


EPS location information 


rrrrrrrrrrrrrrrrrrrrrrrr XXXXXXUUUU 
01 ' (see note 2) 


Drt4 


CDC MAC C^^iii-i+w f^ftntftvt 

tro inao security ooniexi 


■pp pp' 
rr...rr 


DrtD 


ruDiic oervice luenuty ot ine oivi-oo 


Operator dependent 


DrtD 


1 ICAT Po^ilitw C*r\r\\rr\\ 

uoai raciniy ooniroi 


'on 1 p en a p qc\ nn on n/i nn nn nn 
BU 1 1 DU L>U 1 1 yU UU bU U4 UU UU UU 

00 00 00 00 00 FO 00 00 00 00 40 00 

UU UU UU UU UU \\J UU UU UU UU H-U UU 

00 00 00 00 00 80' 


'6FE7' 


UICC IARI 


Operator dependent 


'6FE8' 


Non Access Stratum Configuration 


Operator dependent 


'6FE9' 


UICC certificate 


Card Issuer / Operator dependent 


'6FEA' 


Relay Node ID 


Operator dependent 


'6FEB' 


Max value of Secure Channel counter 


FF..FF 



NOTE 1: The value '000000' means that ACMmax is not valid, i.e. there is no restriction on the ACM. When 

assigning a value to ACMmax, care should be taken not to use values too close to the maximum possible 
value 'FFFFFF', because the INCREASE command does not update EF AC m if the units to be added would 
exceed FFFFFF'. This could affect the call termination procedure of the Advice of Charge function. 

NOTE 2: xxxxxx stands for any valid MCC and MNC, coded according to TS 24.008 [9]. 
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Annex F (informative): 

Examples of coding of LSA Descriptor files for SoLSA 

The length of all the records is determined by the LSA descriptor containing the largest number of bytes. Combinations 
containing different numbers of LSa IDs, LAC+ CI and CI or LAC can therefore be done. Various examples are show. 
Due to the OTA management of the records it is recommended that the record length is maximum 100 bytes in order to 
leave room for command descriptor and signature information in the SMS. 

This first example contains two LSAs, one described by two LSa IDs and another described by three Cell IDs, giving a 
record length of 8 bytes. 



1 st record: 


LSA descriptor 


LSA ID (3 bytes) 


LSA ID (3 bytes) 


Identifier (1 byte) 




type = LSA ID 










and number = 2 










(1 byte) 









2™ record: 



LSA descriptor 


CI (2 bytes) 


CI (2 bytes) 


CI (2 bytes) 


Identifier (1 byte) 


type = CI and 










number = 3 










(1 byte) 











The second example contains two LSAs, one described by one LSA ID and one described by two Cell Ids, giving a 
record length of 6 bytes. 



1 st record: 



LSA descriptor 


LSA ID (3 bytes) 


'FF' 


Identifier (1 byte) 


type = LSA ID 








and number = 1 








(1 byte) 









LSA descriptor 


CI (2 bytes) 


CI (2 bytes) 


Identifier (1 byte) 


type = CI and 








number = 2 








(1 byte) 
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Annex G (informative): 
Phonebook Example 

This example phonebook has more than 254 entries. Additional number (3 additional numbers) information, second 
name and e-mail information can be added to each ADN entry. In addition each entry has a 2 byte Unique ID (UID) 
attached to it. The phonebook also contains three files that are shared EF EX ti, EF aas and EF GAS . These files are 
addressed from inside a file. EF E xti is addressed via EF ADNi EF A dni, EF aas is addressed via EF ANRA> EF ANRA i, EF ANRB , 
EFanrbi, EF anrc , EF ANRC i and EF GAS is addressed via EF GRPi EF GRP1 . The phonebook supports two levels of grouping 
and hidden entries in EF PB c. 

Two records are needed in the phonebook reference file PBR '4F30' for supporting more than 254 entries. The content 
of the phonebook reference file PBR 4F30' records is as shown in table G.2. The structure of the DF PHO nebook is shown 
in table G.l. 

The content of phonebook entries in the range from 1-508 is described in the tables G.3 and G.4. 

Table G.1 : Structure of EFs inside DF PH onebook 



DF PH0NEB00K 
' 5F3A' 



Common Files 



EF PBR 
1 4F30 ' 



FF EXT1 
' 4F4A' 



'4F4B' 



FF GAS 
'4F4C 



EF PSC 
1 4F22 ' 



EF CC 
1 4F2 3 1 



FjF pdid 
i 4F 24 ' 



PhoneBook Setl 



FF ADN 
1 4F3A' 



EF PBC 
i 4F09 ' 



FFfljjpA 
1 4F11 ' 



EFfljjKB 

1 4F13 ' 



EF EMAIL 
1 4F50 ' 



EF SNE 
1 4F19 1 



FF UID 
1 4F21 ' 



FF GRP 
1 4F26 ' 



FFftHpc 
' 4F15 1 



PhoneBook Set2 





FF flDN1 
'4F3B' 




FF PBC1 
'4F0A' 




FF^pft! 

1 4F12 ' 




FF^pB! 

i 4F14 t 


























FF EMflIL1 
1 4F51 ' 




EF SHE1 

' 4F1A' 




ef uidi 
' 4F2 1 




EF GEP1 
1 4F25 ' 




FjFfljjKC! 

'4F16 1 
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Rec 1 




|Tag'C4'| L='(M 



|Tag'C3'| L^'03 7 



|Tag'AA'| L^'OP 
|Tag'C2'| L='(M 



Table G.2: Contents of EF PBR 

(for Phonebook Set1) 



L='03' '4F09' '02' 



L='03' '4F26' '03' 



'4F11' | '04' |Tag'C4'| L='Q3' | '4F13' | '05' |Tag'C4'| L='Q3' | '4F15' 



'06' 



'4F19' | '07' |Tag'C9'| L='03' | '4F21' | '12' |Tag'CA'| L='03' |'4F50' 



'09' 



'4F4A' | '08' |Tag'C7'| L='03' | '4F4B' | '14' |Tag'C8'| L='03' | '4F4C | '15' 



Rec 2 |Tag'A8'| L='2"D r 



L='03' 




L='03' 



L='03' 



|Tag'AA'| L='0F 



(for Phonebook Set 2) 



'4F3B' | 'OA' |Tag'C5'| L='03' | '4F0A' | '0B' |Tag'C6'| L='03' | '4F25' | 'PC 



'4F12' '0D 



'4F1A' '10' 




L='03' '4F14' '0E' 



L='03' '4F20' '13' 




L='03' '4F16' 'OF' 



L='03' '4F51' '11' 



Tag'C2'| L='03' | '4F4A' | '08' |Tag'C7'| L='03' | '4F4B' | '14' |Tag'C8'| L='03' | "4F4C | '15' 



Table G.3: Structure of the 254 first entries in the phonebook 



Phone 
book 
entry 



ADN 
'4F3A' 
SFI '01' 



PBC 
'4F09' 
SFI '02' 



GRP 
'4F26' 
SFI '03' 



ANRA 
'4F11' 
SFI '04' 



ANRB 
'4F13' 
SFI '05' 



ANRC 
'4F15' 
SFI '06' 



SNE 
'4F19' 
SFI '07' 



UID 

'4F21' 
SFI '12' 



EXT1 
'4F4A' 
SFI '08' 



AAS 
'4F4B' 
SFI '14' 



GAS 
'4F4C 
SFI '15' 



EMAIL 

'4F50' 
SFI '09' 



#1 



ADN 
Content 

Bytes 

(1- 
(X+13)) 



EXT1 
Ident. 
(Byte 
X+14): 
Rec '02' 



Hidden 
(AID rec 

N°3) 



Rec n°1 
Rec n°3 
'00' 



ANRA 
Rec n°1 



ANRB 
Rec n°1 



ANRC 
Rec n°1 



Second 
Name 
Alpha 
String 



UID 



Rec '02' 



Record 
numbers 
as 

defined in 
the 
ANRs 



Record 
no.'s as 
defined 
in GRP 



email 
address 



#2 



#3 



ADN 
Content 
Bytes 

(1- 
(X+13)) 



EXT1 
Ident. 
(Byte 
X+14): 
Rec '2A' 



Not 
Hidden 



Rec n°2 
Rec n°1 
Rec n°3 



ANRA 
Rec n°2 



ANRB 
Rec n°2 



ANRC 
Rec n°2 



Second 
Name 
Alpha 
String 



UID 



Rec '2A' 



Record 
numbers 
as 

defined in 
the 
ANRs 



Record 
no.'s as 
defined 
in GRP 



email 
address 



#254 
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Table G.4: Structure of phone book entries 255 to 508 (Rec 1-254) 



Phone 


ADN1 


PBOl 


fciRPI 


A MD A -< 

ANRAl 


AIMRBl 


ANROI 


oNbl 


■ im-i 
UIDl 


EXT1 


A A O 

AAo 


GAo 


nil All ^ 


book 


'4F3B' 


'4F0A' 


'4F25' 


'4F12' 


'4F14' 


'4F16' 


'4F1 A' 


'4F20' 


'4F4A' 


'4F4B' 


'4F4C 


'4F51' 


entry 


SFI 'OA' 


orl Ub 


orl UO 


orl UU 


OCI 'AC 

orl Ub 


OCI 'AC 

orl Ur 


oci Mn 1 
orl 10 


OCI *H Q* 

orl 10 


oci 'no' 
orl Uo 


OCI *H A' 

orl 14 


OCI M C 

orl lo 


OCI HH 1 

orl 1 1 


#255 


ADN 


EXT1 


Hidden 


Rec n°1 


ANRA1 


ANRB1 


ANRC1 


Second 


UID 


Rec '03' 


Record 


Record 


email 




OUI llcl 11 


lUcl 11. 


(AID 


Rec n°3 


Rec n°1 


Rec n°1 


Rec n°1 


Name 






numbers 


no.'s as 


address 




Bytes 


(Byte 


Rec n° 


'00' 








Alpha 






as 


defined 






(1- 


X+14): 


■3) 










String 






HofinoH in 

Ucl 1 1 IcU 1 1 1 








(X+13)) 


Rec '03' 


















the 


GRP1 


























ANRs 






#256 


ADN 


EXT1 


Not 


Rec n°2 


ANRA1 


ANRB1 


ANRC1 


Second 


UID 


Rec '2B' 


Record 


Record 


email 




Content 


Ident. 


Hidden 


Rec n°1 


Rec n°2 


Rec n°2 


Rec n°2 


Name 






numbers 


no.'s as 


address 




Bytes 


(Byte 




Rec n°3 








Alpha 






as 


defined 






(1- 


X+14): 












String 






defined in 


in 






(X+13)) 


Rec '2B' 


















the 


GRP1 


























ANRs 






#257 
















































































































#508 
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Annex H (normative): 
List of SFI Values 

This annex lists SFI values assigned in the present document. 



H.1 List of SFI Values at the USIM ADF Level 



File Identification 


SFI 


Description 


'6FB7' 


■or 


Emergency call codes 


'6F05' 


'02' 


Language indication 


'6FAD' 


'03' 


Administrative data 


'6F38' 


'04' 


USIM service table 


'6F56' 


'05' 


Enabled services table 


'6F78' 


'06' 


Access control class 


'6F07' 


'07' 


IMSI 


'6F08' 


'08' 


Ciphering and integrity keys 


'6F09' 


'09' 


Ciphering and integrity keys for packet switched domain 


'6F60' 


'OA' 


User PLMN selector 


'6F7E 


'0B' 


Location information 


'6F73' 


'0C 


Packet switched location information 


'6F7B' 


'0D' 


Forbidden PLMNs 


'6F48' 


'0E' 


CBMID 


'6F5B' 


'OF' 


Hyperframe number 


'6F5C 


'10' 


Maximum value of hyperframe number 


'6F61' 


■11' 


Operator PLMN selector 


'6F31' 


'12' 


Higher Priority PLMN search period 


'6F62' 


'13' 


Preferred HPLMN access technology 


'6F80' 


'14' 


Incoming call information 


'6F81' 


'15' 


Outgoing call information 


'6F4F' 


'16' 


Capability configuration parameters 2 


'6F06' 


'17' 


Access Rule Reference 


'6FC5' 


'19' 


PLMN Network Name 


'6FC6' 


'1A' 


Operator Network List 


'6FCD' 


■1B' 


Service Provider Display Information 


"6F39" 


"1C" 


Accumulated Call Meter (see note) 


'6FD9' 


'1D' 


Equivalent HPLMN 


'6FE3' 


'1E' 


EPS location information 


'6FE4' 


'18' 


EPS NAS Security Context 


NOTE: When used the value "1C" shall be used as SFI for EFacm, for compatibility reasons the terminal shall 
accept other values. 



All other SFI values are reserved for future use. 



H.2 List of SFI Values at the DF GSM-ACCESS Level 



File Identification 


SFI 


Description 


'4F20' 


'01' 


GSM Ciphering Key Kc 


'4F52' 


'02' 


GPRS Ciphering Key KcGPRS 



All other SFI values are reserved for future use. 
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H.3 List of SFI Values at the DF WLAN Level 



File Identification 


SFI 


Description 


'4F41' 


'01' 


Pseudonym 


'4F42' 


'02' 


User controlled PLMN for WLAN 


'4F43' 


'03' 


Operator controlled PLMN for WLAN 


'4F44' 


'04' 


User controlled WSID list 


'4F45' 


'05' 


Operator controlled WSID list 


'4F46' 


'06' 


WLAN Reauthentication Identity 


'4F47' 


'07' 


Home l-WLAN Specific Identifier List 


'4F48' 


'08' 


l-WLAN Equivalent HPLMN Presentation Indication 


'4F49' 


'09' 


l-WLAN HPLMN Priority Indication 


'4F4A' 


'OA' 


l-WLAN Last Registered PLMN 


'4F4B' 


'OB' 


HPLMN Direct Access Indicator 



All other SFI values are reserved for future use. 



H.4 List of SFI Values at the DF HNB Level 



File Identification 


SFI 


Description 


'4F81' 


■or 


Allowed CSG lists 


'4F82' 


'02' 


CSG Type 


'4F83' 


'03' 


HNB name 


'4F84' 


'04' 


Operator CSG lists 


'4F85' 


'05' 


Operator CSG Type 


'4F86' 


'06' 


Operator HNB name 



All other SFI values are reserved for future use. 
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Annex I (informative): 

USIM Application Session Activation/Termination 

The purpose of this annex is to illustrate the different Application Session procedures. 

Terminal UICC 



Application selection 




Select AID=USIM 






(P2='00') > 




r 


Select File ^ 


Application initialisation 
procedure < - 




Read Binary ^ 






Application initialisation 
procedure is terminated 




Status ^ 




(P1='01') 



Figure 1.1 USIM Application Session Activation procedure 



Terminal 



UICC 



Application 

termination procedure 
is started 



Application termination 
procedure *S 



Application closure 



Status 




(P1='02') 


► 


Select File 




Update Binary 


► 


Select AID=USIM 


► 


(P2='4X") 





Figure I.2 USIM Application Session Termination procedure 
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Annex J (informative): 
Example of MMS coding 



This annex gives an example for the coding of MMS User Preferences, while the MMS User Information Preference 
parameters are coded according to the WAP implementation of MMS. 

J.1 Coding example for MMS User Preferences 

0x80 MMS Implementation Tag 
0x01 (Length = "1") 

0x01 (MMS implementation information = "(WAP") 
0x81 MMS User Preference Profile Name Tag 
OxOE (Length = "14") 

43 68 72 69 73 74 6D 61 73 20 43 61 72 64 
(profile name = "Christmas Card"; 14 characters, 14 Bytes) 
0x82 MMS User Information Preference Information Tag 
0x19 (Length = "25") 

0x14 0x80 (visibility: = "hide"; 2 Bytes) 
0x06 0x80 (delivery report: = "yes"; 2 Bytes) 
0x10 0x80 (read-reply: = "yes"; 2 Bytes) 
OxOF 0x81 (priority: = "normal"; 2 Bytes) 
0x07 0x07 0x80 0x05 0x1 1 0x22 0x33 0x44 0x55 

(Delivery-Time-Tag, Value-Length, Absolute-Token-Tag, Date-Value-Length, Date-Value; 9 Bytes) 
0x08 0x06 0x8 1 0x04 0x55 0x22 0x33 0x44 

(Expiry Tag, Value-Length, Relative-Token-Tag, Delta-Second-Value-Length, Delta-Second-Value; ! 
Bytes) 

J.2 Coding Example for MMS Issuer/User Connectivity 
Parameters 

OxAB MMS Connectivity Parameters Tag 

0x81 0x88 (Length = "136") (Length bytes greater than 127 are coded onto 2 bytes according to ISO/IEC 8825-1 [35]) 
0x80 MMS Implementation Tag 

0x01 (Length = "1") 

0x01 (MMS implementation information = "WAP"; 1 Byte) 
0x81 MMS Relay/Server Tag 

0x17 (Length = "23") 
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0x68 0x74 0x74 0x70 0x3 A 0x2F 0x2F 0x6D 0x6D 0x73 0x2D 0x6F 0x70 0x65 0x72 0x61 0x74 
0x6F 0x72 0x2E 0x63 0x6F 0x6D 

(MMS Relay/Server information = "http://mms-operator.com"; 23 characters; 23 Bytes) 

0x82 Interface to Core Network and Bearer Tag 

0x32 (Length = "50") 

0x10 OxAA (bearer = "GSM-CSD"; 2 Bytes) 

0x08 0x2B 0x34 0x39 0x35 0x33 0x34 0x31 0x39 0x30 0x36 0x00 
(address = "+495341906", 12 Bytes) 

0x09 0x87 (type of address = "E164"; 2 Bytes) 

0x25 0xC5 (speed = "autobauding"; 2 Bytes) 

OxOA 0x90 (call type = "ANALOG_MODEM"; 2 Bytes) 

OxOC 0x9A (authentication type = "PAP"; 2 Bytes) 

OxOD 0x64 0x75 0x6D 0x6D 0x79 0x1 1 0x6E 0x61 0x6D 0x65 0x00 
(authentication id = "dummy_name"; 12 Bytes) 

OxOE 0x64 0x75 0x6D 0x6D 0x79 0x1 1 0x70 0x61 0x73 0x73 0x77 0x6F 0x72 0x64 0x00 
(authentication pw = " dummy _p as sword"; 16 Bytes) 

0x83 Gateway Tag 

0x36 (Length ="54") 

0x20 0x31 0x37 0x30 0x2E 0x31 0x38 0x37 0x2E 0x35 0x31 0x2E 0x33 0x00 
(address = "170.187.51.3"; 14 Bytes) 

0x21 0x85 (type of address = "IPv4"; 2 Bytes) 

0x23 0x39 0x32 0x30 0x33 0x00 (port = "9203"; 6 Bytes) 

0x24 OxCB (service = "CO-WSP"; 2 Bytes) 

0x19 0x9C (authentication type = "HTTP BASIC"; 2 Bytes) 

OxlA 0x64 0x75 0x6D 0x6D 0x79 0x1 1 0x6E 0x61 0x6D 0x65 0x00 
(authentication id = "dummy_name"; 12 Bytes) 

OxlB 0x64 0x75 0x6D 0x6D 0x79 0x1 1 0x70 0x61 0x73 0x73 0x77 0x6F 0x72 0x64 0x00 
(authentication pw = "dummy_password"; 16 Bytes) 
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Annex K (informative): 
Examples of VServiceJd coding 

This annex gives examples for the coding of VServiceJd, 
It is assumed that: 

acknowledgement flag bit is set to 0; 

the call priority bits are set to 0. 



Groupld 


Content of EFvbs or EFvgcs 


VServiceJd(vbs) 


VServiceJd(vgcs) 


00000000 


F0FFFFFF 


00000000 


00000010 


00000001 


F1FFFFFF 


00000020 


00000030 


00000012 


21 FFFFFF 


00000180 


00000190 


00000123 


21 F3FFFF 


00000F60 


00000F70 


00001234 


2143FFFF 


00009A40 


00009A50 


00012345 


2143F5FF 


00060720 


00060730 


00123456 


214365FF 


003C4800 


003C4810 


01234567 


214365F7 


025AD0E0 


025AD0F0 


12345678 


21436587 


178C29C0 


178C29D0 


99999999 


99999999 


BEBC1FE0 


BEBC1FF0 


13452670 


31546207 


19A8AFC0 


19A8AFD0 
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Annex 
USIM- 



L (normative): 

INI and USIM-RN for Relay Nodes 



L.1 



Introduction 



USIM-RN and USIM-INI are used for Relay Node network connections establishment. 

USIM-INI, if present on the UICC, and USIM-RN include at least all mandatory files defined for a USIM in the present 
document, with the exception of files related to emergency calls. 

Editor's note: It is FFS whether the list of files mandatory to support can be reduced further. 

USIM-INI is only required in case of a certificate based solution as described in TS 33.401 [52]. 

For the certificate -based solution, the UICC shall support BIP-UICC server mode (see TS 31.111 [12]) and may support 
the Inter-Chip USB UlCC/terminal interface (see TS 31.101 [1 1]) to perform the TLS handshake. 

The USIM-RN is used to ensure a one to one binding with the Relay Node. The security architecture for Relay Nodes is 
defined in TS 33.401 [52]. 

L.2 Application selection procedure 

Application selection is performed according to the procedures defined in clause 5.1.1.1. The following provisions 
apply: 

When using pre-shared keys, only a USIM-RN is required, and the Relay Node will establish directly a secure channel 
with USIM-RN. It is assumed that the Relay Node knows the "3G application code" within the PIX value reserved for 
3GPP USIM-RN. 

When using certificate based procedure, the UICC inserted in the Relay Node shall contains two USIMs, the USIM-RN 
and USIM-INI. In case initial provisioning is required, the Relay Node will first select USIM-INI, either by direct 
application selection or by use of the EF_DIR file. 

1. Direct application selection: with full or with partial AID. It is assumed that the Relay Node knows the "3G 
application code" within the PIX value reserved for 3GPP USIM-INI. 

2. By use of the EF_DIR file: The Relay Node identifies the USIM-INI, which is characterised by an AID with a 
"3G application code" within the PIX value reserved for 3GPP USIM-INI, see TS 31.101 [11], and selects the 
USIM-INI by AID. The AID of the USIM-RN is characterised by an AID with a "3G application code" within 
the PIX value reserved for 3GPP USIM-RN, see TS 3 1 . 1 1 [ 1 1 ] . If the only applications present in EF_DIR are 
a USIM-RN and a USIM-INI, the terminal omits user presentation and proceeds to application selection. 

The USIM applications USIM-INI and USIM-RN are not simultaneously active. USIM-INI is used to establish an 
initial network connection and USIM-INI is deactivated once the network related operations are finished. USIM-INI is 
deactivated prior to activating USIM-RN. 

USIM-INI may be selected on any logical channel, see TS 31.101 [11]. Prior to selecting USIM-RN a new logical 
channel shall be opened using the MANAGE CHANNEL command as specified in TS 31.101 [11], an application to 
application secure channel can only be established on a logical channel different from channel 0. USIM-RN is then 
selected on the new logical channel. 
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USIM-RN shall be configured to support implicit and explicit application selection. The Relay Node will first select 
USIM-INI, according to the application selection mechanisms specified inTS 31.101 [11]. When the USIM-RN is 
selected explicitly, the Relay Node shall send a SELECT by AID APDU command in clear text prior to secure channel 
establishment. The implicit selection mechanism is performed by specifying USIM-RN AID in the MANAGE 
SECURE CHANNEL - Establish Master SA command. 

L.3 Secure channel operation 

The USIM-RN shall allow communication only via "Secured APDU" secure channel as defined in ETSI TS 102 484 
[66]. 

NOTE: The above implies in particular that the AUTHENTICATE command to the USIM-RN is not executed 
outside the secure channel. In case the pre-shared key solution is used to establish the secure channel only the USIM-RN 
is required for establishing the connection, and the Relay Node will establish directly a secure channel with the USIM- 
RN before attaching to the network. The initial network connection using USIM-INI is not required in this case, and 
hence USIM-INI is not required. 

In case the certificate based solution is used, the UICC inserted in the Relay Node shall contain two USIMs, USIM-RN 
and USIM-INI. A TLS handshake shall be used to provide key material for the Master SA for the secured APDU 
protocol, according to ETSI TS 102 484 [66]. 

L.4 Support of commands 

The Relay Node may limit the set of APDU commands encapsulated in TRANSACT DATA command to the strict 
minimum (READ BINARY, READ RECORD, SELECT, STATUS, UPDATE BINARY, UPDATE RECORD, 
AUTHENTICATE). 

The Relay Node and the UICC shall support letter class 'e' toolkit commands for BIP, see TS 31.111 [ 12] . In order to 
support toolkit the TERMINAL PROFILE, TERMINAL RESPONSE, ENVELOPE and FETCH commands need to be 
supported. These commands are not issued on the secure channel. According to TS 31.1 1 1 [12], US AT commands shall 
be sent on logical channel 0. 

L.5 Storage of certificates 

If the UICC supports the certificate based procedure, the UICC shall be provisioned with the UICC certificate and the 
root certificate. The UICC certificate, which is used as a server certificate in the TLS handshake, is stored in EF CERT in 
USIM-INI as it needs to be accessed by the RN for reading the CRL distribution point before establishing the secure 
channel, for details cf. TS 33.401 [52]. The root certificate, which is used to verify the RN certificate in the TLS 
handshake, is only needed for UlCC-internal purposes and need not be stored in an EF. 

L.6 Relay Node files support 

L.6.1 USIM-INI Files 

L.6. 1 . 1 EFcert (U ICC Certificate) 

This file contains the UICC Certificate. 
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Identifier: '6FE9' 


Structure: transparent 


Optional 






File size: N bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 


ALW 
ADM 
ADM 







ACTIVATE ADM 



Bytes 


Description 


M/O 


Length 


X 


UICC Certificate 


M 


X 


The format is as specified in TS 33.401 [52]. 



L.6.2 USIM-RN Files 

L.6.2.1 eF RNid (Relay Node identifier) 

This EF contains the Relay Node identifier the USIM-RN is bound to, see TS 33.401 [52]. 

An USIM-RN shall contain this file. The content of this file is not intended to be read on UICC-RN interface. It serves 
as a storage location for the Relay Node identifier to which the UICC is bound. The file content is described for the 
purpose of Over-The-Air update. 



Identifier: '6FEA' 



Structure: transparent 



Optional 



File size: N bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



ADM 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 




Country Tag '80' 


O 


1 byte 




Country Length = 2 


C 


1 byte 




Country code (ASCII characters) 


C 


2 bytes 




Organization Tag '81' 


M 


1 byte 




Organization Length 


M 


1 byte 




Organization name (characters coded in UTF8) 


M 


K bytes 




Common Name Tag '82' 


M 


1 byte 




Common Name Length 


M 


1 byte 




Common Name (characters coded in UTF8) 


M 


L bytes 




Serial Number Tag '82' 


O 


1 byte 




Serial Number Length 


C 


1 byte 




Serial Number (characters coded in ASCII) 


C 


M bytes 



NOTE: C: if the Tag is present, this is mandatory 
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L.6.2.2 EFsccmax (maximum value of Secure Channel Counter) 

This EF contains the maximum number of transaction allowed with the same Connection SA, when a secure channel is 
established. When the counter value in TRANSACT DATA command reaches the maximum value, the terminal shall 
derive new key material using Manage Secure Channel APDU - establish SA - Connection SA, see ETSI TS 102.484 
[66]. 

An USIM with an Application ID in the USIM-RN range shall contain this file. 



Identifier: '6FEB' 



Structure: transparent 



Optional 



File size: 8 bytes 



Update activity: low 



Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 



ALW 
ADM 
ADM 
ADM 



Bytes 


Description 


M/O 


Length 


8 


Secure Channel counter 


M 


8 byte 



NOTE: The value of the Secure channel counter is set at personalisation. It is not intended to be updated or modified 
as a result of establishing a new Connection SA. 
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Annex M (informative): 
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